peppol-py vulnerabilities

CVEs whose affected-version data names the peppol-py package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2025-66371Medium· 5.0

11mo ago

Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration

Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the filesystem and expose their content to a remote host.

▾ Sunlitpeppol-py · peppol-pyEPSS 0.32%via NVD