[Docutils-develop] [docutils:bugs] #521 Document fetch triggered by XML writer raw XML validation

[Günter M. <mi...@us...>]

- **status**: open --> open-fixed
- **Comment**:

Fixed in [r10395].



---

**[bugs:#521] Document fetch triggered by XML writer raw XML validation**

**Status:** open-fixed
**Created:** Fri Aug 21, 2026 12:21 PM UTC by Florian Weimer
**Last Updated:** Fri Aug 21, 2026 12:21 PM UTC
**Owner:** nobody
**Attachments:**

- [RHEL-214776.html](https://sourceforge.net/p/docutils/bugs/521/attachment/RHEL-214776.html) (7.8 kB; text/html)


Red Hat Product Security has asked me to forward the attached vulnerability report. I do not think it is a significant issue (perhaps no vulnerability at all), so I'm not filing a private bug for it.

This is a small reproducer:

```
from docutils.core import publish_string
RST_INPUT = """\
.. raw:: xml

   <!DOCTYPE r [<!ENTITY xxe SYSTEM "http://127.0.0.1:9/">]>
   <r>&xxe;</r>
"""
print(publish_string(RST_INPUT, writer_name='xml'))
```

It fails with a `urllib.error.URLError` exception, indicating that the conversion triggered unexpected network activity.

I've been told to mention: Found by AISLE in partnership with Red Hat


---

Sent from sourceforge.net because doc...@li... is subscribed to https://sourceforge.net/p/docutils/bugs/

To unsubscribe from further messages, a project admin can change settings at https://sourceforge.net/p/docutils/admin/bugs/options.  Or, if this is a mailing list, you can unsubscribe from the mailing list.