-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the XML parser configuration in XmlValidator. The commit diff shows the vulnerable version (6.7.0) had 'noent: true' in xmlParseOptions, which explicitly enables entity substitution. This setting is dangerous when processing untrusted XML, as it permits XXE attacks. The patch reverted this configuration by removing 'noent: true', confirming this was the root cause. The validate method in XmlValidator.node.ts executes parsing with these insecure options, making it the vulnerable entry point.
KEV Misses 88% of Exploited CVEs- Get the report
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @cyclonedx/cyclonedx-library | npm | = 6.7.0 | 6.7.1 |