{"cve":"CVE-2021-29421","nvd":{"published":"2021-04-01T20:15:12.453","modified":"2026-06-17T03:47:36.300","status":"Modified","description":"models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-611"],"references":["https://github.com/pikepdf/pikepdf/blob/v2.10.0/docs/release_notes.rst#v2100","https://github.com/pikepdf/pikepdf/commit/3f38f73218e5e782fe411ccbb3b44a793c0b343a","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/36P4HTLBJPO524WMQWW57N3QRF4RFSJG/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QFLBBYGEDNXJ7FS6PIWTVI4T4BUPGEQ/","https://github.com/pikepdf/pikepdf/blob/v2.10.0/docs/release_notes.rst#v2100"],"products":["fedoraproject:fedora","pikepdf_project:pikepdf"],"source":"nvd","synced_at":"2026-10-19T21:17:01.373894544+00:00"},"epss":{"cve":"CVE-2021-29421","score":0.01681,"percentile":0.76951,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-ccgm-3xw4-h5p8","url":"https://osv.dev/vulnerability/GHSA-ccgm-3xw4-h5p8","summary":"Improper Restriction of XML External Entity Reference in pikepdf","modified":"2026-09-10T03:49:03.241318694Z","packages":[{"ecosystem":"PyPI","name":"pikepdf","purl":"pkg:pypi/pikepdf","ranges":[">=1.3.0 <2.10.0"],"fixed":["2.10.0"]}]},{"id":"PYSEC-2021-34","url":"https://osv.dev/vulnerability/PYSEC-2021-34","summary":"","modified":"2023-11-08T04:05:33.347900Z","packages":[{"ecosystem":"PyPI","name":"pikepdf","purl":"pkg:pypi/pikepdf","ranges":[">=1.3.0 <2.10.0"],"fixed":["2.10.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}