The vulnerability permits XML External Entity processing in Bio.Entrez up to revision 186, such that an attacker who supplies a crafted XML document could exploit the entity resolution feature. This weakness may allow the disclosure of information that the process can access, including potentially sensitive files or data, without providing direct code execution or denial of service. The effect depends on how the library interacts with external sources.

The flaw affects the Biopython library (vendor Biopython, product Biopython). All released versions through revision 186 are impacted; later revisions are not covered by the description. The library is typically used in Python environments that parse XML with Bio.Entrez, so any deployment of Biopython in such contexts is potentially exposed.

The CVSS base score of 4.9 indicates moderate severity. The EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a malicious XML document through code that invokes Bio.Entrez, so the attack vector is application‑level data input rather than a pure network or remote code execution vector. Given the limited exploitation scope and low EPSS, the overall risk to systems using unpatched Biopython is moderate, yet timely remediation is advised.