Improper Restriction of XML External Entity Reference
pikepdf before 2.10.0 allows an XXE attack against PDF XMP metadata parsing.
Advisories for Pypi/Pikepdf package
2022
2021
Improper Restriction of XML External Entity Reference
models/metadata.py in the pikepdf package for Python allows XXE when parsing XMP metadata entries.