When parsing untrusted XML files or configuration data in a Python application, why is the standard xml.etree.ElementTree library considered a security risk?

Answer as guest — Start Free Practice Test to earn Practice PointsHow to earn pointsAsk a question+3Answer a question+1Someone answers yours+1Your Q gets upvoted+1Pioneer bonus (first 5)+5, ask questions & climb the leaderboard!

A It lacks support for multi-language string encodings.
B It automatically executes embedded Python scripts via macros.
C It is inherently vulnerable to XML External Entity (XXE) and billion laughs denial-of-service attacks.
D It leaks memory by failing to garbage-collect parsed trees.

Show answer and explanation

Answer: C. It is inherently vulnerable to XML External Entity (XXE) and billion laughs denial-of-service attacks.

Answer: C) It is inherently vulnerable to XML External Entity (XXE) and billion laughs denial-of-service attacks.
Explanation: The standard Python XML parsers are not secure against maliciously constructed XML data. An attacker can use external entities to read local files (XXE) or use recursive expansion to crash the server. Security professionals use hardened alternatives like defusedxml.

Answering after opening this box earns no Practice Points.

Rules for asking and answering

When parsing untrusted XML files or configuration data in a Python application, why is the standard xml.etree.ElementTree library considered a security risk?

More questions like this