pypi package report

Is openpyxl safe?

1 known vulnerability, worst severity MODERATE.

// reach

1 direct dependencies

none carry a known advisory

277 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade

// ai model usage

No published models are known to use this package.

cvss

8.2

high

CVSS v3.0 base score out of 10; GitHub rates it MODERATE

epss

1.4%

medium

chance of exploitation in 30 days, 73rd percentile of all CVEs

xyz score

not scored

CyberXYZ composite out of 10

fig. 01 — GHSA-chqf-hx79-gxc6, the advisory selected below

// 1 advisories

GHSA-chqf-hx79-gxc6

MODERATEGitHub ratingCVE-2017-5992

Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document.

// cvss v3.0 vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H

Attack vector: Local
Attack complexity: Low
Privileges required: None
User interaction: Required
Scope: Changed
Confidentiality: High
Integrity: None
Availability: High

Checked 2026-11-06 at 23:50 UTC. The most recent advisory here was published 2022-05-17. Updated continuously from NVD, GHSA, OSV and CNA feeds.