# libexpat 2.2.6 version presents some vulnerabilities

**URL:** <https://discourse.vtk.org/t/libexpat-2-2-6-version-presents-some-vulnerabilities/2697>\
**Category:** Development\
**Created:** [February 25, 2020, 11:53am UTC](https://discourse.vtk.org/t/libexpat-2-2-6-version-presents-some-vulnerabilities/2697 "2020-02-25T11:53:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![simonesneault](https://discourse.vtk.org/user_avatar/discourse.vtk.org/simonesneault/32/67_2.png) [@simonesneault](https://discourse.vtk.org/u/simonesneault)\
**Post date:** [February 25, 2020, 11:53am UTC](https://discourse.vtk.org/t/libexpat-2-2-6-version-presents-some-vulnerabilities/2697/1 "2020-02-25T11:53:01Z")

</div>

Hi All,

The embedded version of libexpat (2.2.6) in VTK presents some vulnerabilities :

- [https://nvd.nist.gov/vuln/detail/CVE-2019-15903](https://nvd.nist.gov/vuln/detail/CVE-2019-15903)
- [https://nvd.nist.gov/vuln/detail/CVE-2018-20843](https://nvd.nist.gov/vuln/detail/CVE-2018-20843)

Would it be possible to bump the version to 2.2.8 before the upcoming 9.0 release ?  
Or is there a way to build VTK without the use of this library?  
Thanks

---

<div class="post-metadata">

**Author:** ![simonesneault](https://discourse.vtk.org/user_avatar/discourse.vtk.org/simonesneault/32/67_2.png) [@simonesneault](https://discourse.vtk.org/u/simonesneault)\
**Post date:** [February 28, 2020, 10:03am UTC](https://discourse.vtk.org/t/libexpat-2-2-6-version-presents-some-vulnerabilities/2697/2 "2020-02-28T10:03:31Z")

</div>

@ben.boeckel Should I prepare a PR for this ?  
Can that kind of change (upgrading a lib version) have a big impact on the framework ?  
Thanks

---

<div class="post-metadata">

**Author:** ![ben.boeckel](https://discourse.vtk.org/letter_avatar_proxy/v4/letter/b/ea5d25/32.png) [@ben.boeckel](https://discourse.vtk.org/u/ben.boeckel)\
**Post date:** [February 28, 2020, 2:38pm UTC](https://discourse.vtk.org/t/libexpat-2-2-6-version-presents-some-vulnerabilities/2697/3 "2020-02-28T14:38:37Z")

</div>

I tried updating in and found issues (noted in [this comment](https://gitlab.kitware.com/vtk/vtk/merge_requests/6340#note_674527)). [This issue](https://gitlab.kitware.com/vtk/vtk/issues/17756) is what resulted.