~ / search / GHSA-93m7-c69f-5cfj

GHSA-93m7-c69f-5cfj

xmlquery lacks check for whether LoadURL response is in XML format, causing denial of service

Source: GitHub Advisory Database (reviewed) High CVE-2020-25614

Packages

EcosystemPackageAffectedFixed in
Go github.com/antchfx/xmlquery < 1.3.1 1.3.1

Details

As written in the advisory (Markdown source, shown as plain text).

xmlquery before 1.3.1 lacks a check for whether a LoadURL response is in the XML format, which allows attackers to cause a denial of service (SIGSEGV) at xmlquery.(*Node).InnerText or possibly have unspecified other impact.

References

External links from the advisory. They lead to third-party sites.