CVE-2024-34394: libxmljs2 vulnerable to type confusion when parsing specially crafted XML
libxmljs2 is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking the namespaces() function (which invokes XmlNode::getlocalnamespaces()) on a grand-child of a node that refers to an entity. This vulnerability can lead to denial of service and remote code execution.
Published May 2, 2024 · Updated Nov 25, 2024
Affected packages
libxmljs2
- Ecosystem
- npm
- Affected
- <= 0.35.0
- Fixed in
- No patched version yet
- Check
npm ls libxmljs2
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
libxmljs2 is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking the namespaces() function (which invokes XmlNode::get_local_namespaces()) on a grand-child of a node that refers to an entity. This vulnerability can lead to denial of service and remote code execution.
Credited to macariomartins.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology