CVE-2024-34391: libxmljs vulnerable to type confusion when parsing specially crafted XML

May 2, 2024 (updated November 25, 2024)

libxmljs is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking a function on the result of attrs() that was called on a parsed node. This vulnerability might lead to denial of service (on both 32-bit systems and 64-bit systems), data leak, infinite loop and remote code execution (on 32-bit systems with the XML_PARSE_HUGE flag enabled).

References

github.com/advisories/GHSA-6433-x5p4-8jc7
github.com/libxmljs/libxmljs
github.com/libxmljs/libxmljs/issues/645
nvd.nist.gov/vuln/detail/CVE-2024-34391
research.jfrog.com/vulnerabilities/libxmljs-attrs-type-confusion-rce-jfsa-2024-001033988

Code Behaviors & Features

Detect and mitigate CVE-2024-34391 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →