CVE-2025-68463 Details

A vulnerability in Biopython's Bio.Entrez module, present in versions through 186, allows for XML external entity (XXE) attacks. The parser in this module can be tricked into making arbitrary HTTP GET requests. This behavior can be exploited to access internal network resources or cause a denial-of-service. The issue arises because the parser does not properly handle external entities, leading to potential server-side request forgery (SSRF) vulnerabilities. Additionally, the lack of enforced TLS can expose users to man-in-the-middle attacks.

Users are advised to update to a version of Biopython that addresses this vulnerability. Instructions for updating can be found in the Biopython documentation.