CVE-2024-34393: libxmljs2 type confusion vulnerability when parsing specially crafted XML

May 2, 2024 (updated November 25, 2024)

libxmljs2 is vulnerable to type confusion when parsing a specially crafted XML while invoking a function on the result of attrs() that was called on a parsed node. This vulnerability might lead to denial of service (on both 32-bit systems and 64-bit systems), data leak, infinite loop and remote code execution (on 32-bit systems with the XML_PARSE_HUGE flag enabled). At the time of publication, there is no fix.

References

github.com/advisories/GHSA-mjr4-7xg5-pfvh
github.com/marudor/libxmljs2
github.com/marudor/libxmljs2/issues/204
nvd.nist.gov/vuln/detail/CVE-2024-34393
research.jfrog.com/vulnerabilities/libxmljs2-attrs-type-confusion-rce-jfsa-2024-001034097

Code Behaviors & Features

Detect and mitigate CVE-2024-34393 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →