GHSA-mg49-jqgw-gcj6

libxmljs vulnerable to type confusion when parsing specially crafted XML

Source: GitHub Advisory Database (reviewed) Critical CVE-2024-34392

Packages

Ecosystem	Package	Affected	Fixed in
npm	libxmljs	<= 1.0.11	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

libxmljs is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking the `namespaces()` function (which invokes `_wrap__xmlNode_nsDef_get()`) on a grand-child of a node that refers to an entity. This vulnerability can lead to denial of service and remote code execution.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-34392 advisory
https://github.com/libxmljs/libxmljs/issues/646 web
https://github.com/libxmljs/libxmljs package
https://research.jfrog.com/vulnerabilities/libxmljs-namespaces-type-confusion-rce-jfsa-2024-001034096 web