defusedxml

XML bomb protection for Python stdlib modules

defusedxml Permissive license PSFL DORMANT ★ 550 v0.7.1 released 2021-03-08

Install

defusedxml on PyPI

pip

pip install defusedxml

uv

uv add defusedxml

poetry

poetry add defusedxml

Package facts

License	PSFL (permissive)
Python support	supports the current Python release (>=2.7, !=3.0., !=3.1., !=3.2., !=3.3., !=3.4.*)
Install friction	low — pure-Python wheel
Runtime dependencies	none
Maintenance	dormant — 1,984 days since the last release
Last repo commit	2024-09-03
First released	2013-02-19
Popularity	one of the top 1,000 most-downloaded packages on PyPI (30-day window, as of 2026-08-13)
Known vulnerabilities	none known (OSV.dev, checked 2026-08-13)

Evidence: defusedxml-0.7.1-py2.py3-none-any.whl

Keywords: xml, bomb, DoS

Development Status :: 5 - Production/StableIntended Audience :: DevelopersLicense :: OSI Approved :: Python Software Foundation LicenseNatural Language :: EnglishProgramming Language :: PythonProgramming Language :: Python :: 2Programming Language :: Python :: 2.7Programming Language :: Python :: 3Programming Language :: Python :: 3.5Programming Language :: Python :: 3.6Programming Language :: Python :: 3.7Programming Language :: Python :: 3.8Programming Language :: Python :: 3.9Topic :: Text Processing :: Markup :: XML

About defusedxml

from the package's own PyPI description — quoted content, verbatim

=================================================== defusedxml -- defusing XML bombs and other exploits ===================================================

.. image:: https://img.shields.io/pypi/v/defusedxml.svg :target: https://pypi.org/project/defusedxml/ :alt: Latest Version

.. image:: https://img.shields.io/pypi/pyversions/defusedxml.svg :target: https://pypi.org/project/defusedxml/ :alt: Supported Python versions

.. image:: https://travis-ci.org/tiran/defusedxml.svg?branch=master :target: https://travis-ci.org/tiran/defusedxml :alt: Travis CI

.. image:: https://codecov.io/github/tiran/defusedxml/coverage.svg?branch=master :target: https://codecov.io/github/tiran/defusedxml?branch=master :alt: codecov

.. image:: https://img.shields.io/pypi/dm/defusedxml.svg :target: https://pypistats.org/packages/defusedxml :alt: PyPI downloads

.. image:: https://img.shields.io/badge/code%20style-black-000000.svg :target: https://github.com/psf/black :alt: Code style: black

"It's just XML, what could probably go wrong?"

Christian Heimes <christian@python.org>

Synopsis

The results of an attack on a vulnerable XML...

Read as markdown · JSON record · Source repository · Homepage

AI interpretation — verify before relying

AI-generated interpretation of the package facts above; every digit, version, license, or vulnerability id it cites is grounded in the facts already shown on this page

Provides hardened XML parsing wrappers around Python's standard library modules to defend against XML bomb attacks, entity expansion exploits, and external entity injection.

Installs with no runtime dependencies and low friction. Maintenance is dormant—last release was 2021-03-08, over three years ago—but the repository remains active with a recent commit on 2024-09-03, suggesting occasional upkeep rather than abandonment.

Licensed under the Python Software Foundation License (PSFL), a permissive license that allows free use, modification, and distribution with minimal restrictions.

Usage

pip install defusedxml==0.7.1

import defusedxml.ElementTree as ET
tree = ET.parse('file.xml')

Requires Python 2.7 or Python 3.5+; does not support Python 3.0–3.4.

Verdict: defusedxml is a mature, stable library (Production/Stable status since 2013) that addresses well-known XML parsing vulnerabilities with zero security issues reported. Its dormant maintenance posture and three-year release gap are offset by its narrow, focused scope—XML hardening rarely requires active development. Suitable for projects that parse untrusted XML and need defense against billion-laughs, quadratic blowup, and external entity attacks without external dependencies.

Needs verification

Whether the 2024-09-03 commit represents a security patch, documentation update, or maintenance activity that might signal renewed development.
Compatibility with Python 3.10+ beyond the classifiers listed (3.9 is the latest explicitly declared).

xml bomb protectionxml security hardeningentity expansion defensexxe preventionsafe xml parsingxml dos mitigationdefused xml parser