CVE-2021-29421

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

No affected versions have been published.

Timeline

Published
Apr 1, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-294247.5The Net::Netmask module before 2.0000 for Perl does not properly consider extraneous zero characters at the beginning of an IP address strinCVE-2021-294254.8In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\fCVE-2021-294277.2In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poisonCVE-2021-294287.8In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions that allow multiple CVE-2021-294295.5In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacker to access informatCVE-2021-294307.5Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP clients. A malicious user couCVE-2021-294316.5Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter CVE-2021-294325.7Sydent is a reference matrix identity server. A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email addressCVE-2021-294334.3Sydent is a reference Matrix identity server. In Sydent versions 2.2.0 and prior, sissing input validation of some parameters on the endpoinCVE-2021-294344.8Wagtail is a Django content management system. In affected versions of Wagtail, when saving the contents of a rich text field in the admin iCVE-2021-294356.5trestle-auth is an authentication plugin for the Trestle admin framework. A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows anCVE-2021-294368.1Anuko Time Tracker is an open source, web-based time tracking application written in PHP. In Time Tracker before version 1.19.27.5431 a Cros
CVE-2021-29421: High severity, CVSS 7.5 | Vulnix