CVE-2024-34391: libxmljs vulnerable to type confusion when parsing specially crafted XML
libxmljs is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking a function on the result of attrs() that was called on a parsed node. This vulnerability might lead to denial of service (on both 32-bit systems and 64-bit systems), data leak, infinite loop and remote code execution (on 32-bit systems with the XMLPARSEHUGE flag enabled).
Published May 2, 2024 · Updated Nov 25, 2024
Affected packages
libxmljs
- Ecosystem
- npm
- Affected
- <= 1.0.11
- Fixed in
- No patched version yet
- Check
npm ls libxmljs
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
libxmljs is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking a function on the result of attrs() that was called on a parsed node. This vulnerability might lead to denial of service (on both 32-bit systems and 64-bit systems), data leak, infinite loop and remote code execution (on 32-bit systems with the XML_PARSE_HUGE flag enabled).
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology