-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| libxmljs2 | npm | <= 0.33.0 |
Miggo AIRoot Cause AnalysisThe vulnerability manifests when invoking functions on the result of attrs() after parsing crafted XML. The PoC demonstrates attrs() being called on a text node created via entity expansion (c2.attrs()), which should not have attributes. This suggests the underlying C++ binding (XmlElement.attrs in src/xml_element.cc) fails to validate node types properly, returning invalid attribute lists that cause type confusion when accessed. The XML_PARSE_HUGE flag exacerbates this by allowing memory layouts vulnerable to 32-bit RCE.
JavaScriptJavaScriptOngoing coverage of React2Shell