-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from _wrap__xmlNode_properties_get's unsafe type casting logic. The function attempts to convert the JavaScript object to multiple types (_xmlDoc, _xmlAttr, etc.) but notably omits checking for _xmlEntity*. When handling entity nodes, this results in interpreting the entity's 'length' field as a pointer to an _xmlAttr list. This is directly evidenced by the crash in attrs() calls on entity-derived nodes and the structural mismatch between _xmlNode and _xmlEntity layouts described in the issue analysis.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| libxmljs | npm | <= 1.0.11 |