-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from LoadURL's lack of Content-Type validation before parsing. The GitHub commit diff shows this function was patched to add header validation, and the CVE description explicitly cites LoadURL as the entry point for untrusted data. The reproduction example demonstrates crashing through LoadURL -> Parse -> InnerText chain. While InnerText is mentioned in crash reports, the root vulnerability lies in LoadURL's input validation failure (CWE-20).
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/antchfx/xmlquery | go | < 1.3.1 | 1.3.1 |