-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pysaml2 | pip | < 4.5.0 | 4.5.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from PySAML2 using Python's default ElementTree.fromstring for XML parsing, which does not disable external entity processing. The commit 6e09a25 replaced all instances of ElementTree.fromstring with defusedxml.ElementTree.fromstring, which explicitly mitigates XXE. The affected functions directly parsed untrusted SAML/XML input without safe defaults, as evidenced by the patch diff and CWE-611 alignment. Test cases added in the commit (e.g., test_create_class_from_xml_string_xxe) confirm these functions were vulnerable to crafted entity payloads.