GitHub Advisoryadvisory · Packagist

GHSA-2g98-f9jv-w8c5 robrichards/xmlseclibs XPath injection

HIGH Published 2024-05-20 Modified 2024-05-20 Official page ↗
Ecosystem
Packagist
Packages
robrichards/xmlseclibs
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-91
Reviewed
2024-05-20

Affected packages

• Packagist robrichards/xmlseclibs: >= 1.0.0, < 3.0.2 → fixed in 3.0.2

Description

A vulnerability has been identified in the robrichards/xmlseclibs library, specifically related to XPath injection. The issue arises from inadequate filtering of user input before it is incorporated into XPath expressions.

Related

Weakness · CWE (1)

  • CWE-91 XML Injection weakness

References