CVE-2024-37388: Dnkorpushov Ebookmeta

Critical severity, CVSS 9.1. EPSS: 0.5% chance of exploitation in the next 30 days.

An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of lxml before v4.9.1 allows attackers to access sensitive information or cause a Denial of Service (DoS) via crafted XML input.

Affected products

• Dnkorpushov Ebookmeta: before 4.9.1 (fixed in 4.9.1)

Published 2024-06-07. Last modified 2026-06-17.