From 8d8afadee9cd229bc1953c1814d5301c2f9110a2 Mon Sep 17 00:00:00 2001
From: Sanyam Kumat <124618873+sanyamk23@users.noreply.github.com>
Date: Sun, 7 Jun 2026 03:08:15 +0530
Subject: [PATCH] gh-148954: Escape methodname in xmlrpc.client.dumps() to
 prevent XML injection (GH-148968) (cherry picked from commit
 ab930175e7e909aaa3ec7e761bfdbb886677bebb)

Co-authored-by: Sanyam Kumat <124618873+sanyamk23@users.noreply.github.com>
---
 Lib/test/test_xmlrpc.py                               | 11 +++++++++++
 Lib/xmlrpc/client.py                                  |  2 +-
 .../2026-04-24-19-54-00.gh-issue-148954.v1.rst        |  1 +
 3 files changed, 13 insertions(+), 1 deletion(-)
 create mode 100644 Misc/NEWS.d/next/Library/2026-04-24-19-54-00.gh-issue-148954.v1.rst

diff --git a/Lib/test/test_xmlrpc.py b/Lib/test/test_xmlrpc.py
index 2803c6d45c27bfa..ee0e24f6e86ae33 100644
--- a/Lib/test/test_xmlrpc.py
+++ b/Lib/test/test_xmlrpc.py
@@ -208,6 +208,17 @@ def test_dump_encoding(self):
         self.assertEqual(xmlrpclib.loads(strg)[0][0], value)
         self.assertEqual(xmlrpclib.loads(strg)[1], methodname)
 
+    def test_dump_escape_methodname(self):
+        payload = 'foo</methodName><injected attr="evil"/><methodName>bar'
+        s = xmlrpclib.dumps((), methodname=payload)
+        self.assertIn(
+            '<methodName>foo&lt;/methodName&gt;&lt;injected attr="evil"/&gt;'
+            '&lt;methodName&gt;bar</methodName>', s
+        )
+        self.assertNotIn('<injected attr="evil"/>', s)
+        load, m = xmlrpclib.loads(s)
+        self.assertEqual(m, payload)
+
     def test_dump_bytes(self):
         sample = b"my dog has fleas"
         self.assertEqual(sample, xmlrpclib.Binary(sample))
diff --git a/Lib/xmlrpc/client.py b/Lib/xmlrpc/client.py
index f441376d09c4aa2..84e4e4d11a7319e 100644
--- a/Lib/xmlrpc/client.py
+++ b/Lib/xmlrpc/client.py
@@ -965,7 +965,7 @@ def dumps(params, methodname=None, methodresponse=None, encoding=None,
         data = (
             xmlheader,
             "<methodCall>\n"
-            "<methodName>", methodname, "</methodName>\n",
+            "<methodName>", escape(methodname), "</methodName>\n",
             data,
             "</methodCall>\n"
             )
diff --git a/Misc/NEWS.d/next/Library/2026-04-24-19-54-00.gh-issue-148954.v1.rst b/Misc/NEWS.d/next/Library/2026-04-24-19-54-00.gh-issue-148954.v1.rst
new file mode 100644
index 000000000000000..6245af7e362e920
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2026-04-24-19-54-00.gh-issue-148954.v1.rst
@@ -0,0 +1 @@
+Fix XML injection vulnerability in :func:`xmlrpc.client.dumps` where the ``methodname`` was not being escaped before interpolation into the XML body.