CVE-2021-23792

CVE-2021-23792 is an XML External Entity (XXE) Injection vulnerability affecting the twelvemonkeys_project imageio-metadata package prior to version 3.7.1. This critical flaw, with a CVSS score of 9.8, allows an unauthenticated attacker to achieve full compromise (confidentiality, integrity, availability) by supplying a malicious file containing an XMP segment, such as an uploaded profile picture. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion with over 10 mentions, indicating awareness among security researchers.