CVE-2024-34392

CVE-2024-34392 · libxmljs namespaces type confusion RCE

This page contains facts from public vulnerability sources. Check the original advisory before updating.

libxmljs is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking the namespaces() function (which invokes _wrap__xmlNode_nsDef_get()) on a grand-child of a node that refers to an entity. This vulnerability can lead to denial of service and remote code execution.

CVSS 8.1 · High · EPSS 1.1%

Published

2024-05-02T18:55:38.219Z

Updated

2024-11-25T12:54:47.608Z

Stack: node

Check your server →