---
id: defusedxml
version: "0.7.1"
license: PSFL
license_treatment: permissive
maintenance: dormant
---

# defusedxml — XML bomb protection for Python stdlib modules

License: permissive · Maintenance: dormant · Popularity: top 1,000 on PyPI

## Install

pip install defusedxml
uv add defusedxml
poetry add defusedxml

## Description

===================================================
defusedxml -- defusing XML bombs and other exploits
===================================================

.. image:: https://img.shields.io/pypi/v/defusedxml.svg
    :target: https://pypi.org/project/defusedxml/
    :alt: Latest Version

.. image:: https://img.shields.io/pypi/pyversions/defusedxml.svg
    :target: https://pypi.org/project/defusedxml/
    :alt: Supported Python versions

.. image:: https://travis-ci.org/tiran/defusedxml.svg?branch=master
    :target: https://travis-ci.org/tiran/defusedxml
    :alt: Travis CI

.. image:: https://codecov.io/github/tiran/defusedxml/coverage.svg?branch=master
    :target: https://codecov.io/github/tiran/defusedxml?branch=master
    :alt: codecov

.. image:: https://img.shields.io/pypi/dm/defusedxml.svg
    :target: https://pypistats.org/packages/defusedxml
    :alt: PyPI downloads

.. image:: https://img.shields.io/badge/code%20style-black-000000.svg
    :target: https://github.com/psf/black
    :alt: Code style: black

..

    "It's just XML, what could probably go wrong?"

Christian Heimes <christian@python.org>

Synopsis
========

The results of an attack on a vulnerable XML...

## AI interpretation — verify before relying

Provides hardened XML parsing wrappers around Python's standard library modules to defend against XML bomb attacks, entity expansion exploits, and external entity injection.

Verdict: defusedxml is a mature, stable library (Production/Stable status since 2013) that addresses well-known XML parsing vulnerabilities with zero security issues reported. Its dormant maintenance posture and three-year release gap are offset by its narrow, focused scope—XML hardening rarely requires active development. Suitable for projects that parse untrusted XML and need defense against billion-laughs, quadratic blowup, and external entity attacks without external dependencies.

[View on SkillFed](https://skillfed.io/packages/defusedxml) · [View on PyPI](https://pypi.org/project/defusedxml/)