Upgrading xmltodict 0.14 to 0.15
Safe0.14.2 → 0.15.1Security1
SecurityPrevents XML injection (CVE-2025-9375) by rejecting '<' and '>' in element and attribute names, including @xmlns prefixes, during unparse.CVE-2025-9375 ↗
SafeUpgrade verdict
A security fix. Nothing to change in your code.
In plain terms
- When converting data back into XML, names containing angle brackets are now rejected so malicious input cannot inject extra XML tags.
Must act 1 item needs code or config changes
Python requirement changed in 0.15.1: >=3.6 → >=3.9.
What you must change
Security1
Prevents XML injection (CVE-2025-9375) by rejecting '<' and '>' in element and attribute names, including @xmlns prefixes, during unparse.
unparse@xmlnsXMLGenerator