GHSA-38gf-rh2w-gmj7 @cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability

• npm @cyclonedx/cyclonedx-library: >= 6.7.0, < 6.7.1 → fixed in 6.7.1

Impact XML External entity injections could be possible, when running the provided XML Validator on arbitrary input. POC ```js const { Spec: { Version }, Validation: { XmlValidator } } = require('@cyclonedx/cyclonedx-library'); const version = Version.v1dot5; const validator = new XmlValidator(version); const input = ` ]> testing 1.337 &xxe; `; // validating this forged(^) input might lead to unintended behaviour // for the fact that the XML external entity would be taken into account. validator.validate(input).then(ve => { console.error('validation error', ve); }); ``` Patches This issue was fixed in `@cyclonedx/[email protected] `. Workarounds Do not run the provided XML validator on untrusted inputs. References • issue was introduced via .