-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in the C++ binding layer of libxmljs, specifically in the property getter for the internal _ref property of wrapped XML node objects. This getter does not correctly handle nodes of type entity_ref or entity_decl, leading to a segmentation fault and a denial-of-service when the _ref property is accessed. While the root cause is in the native C++ code, the provided vulnerable functions are the JavaScript functions that would appear in a runtime profile during an exploit. An attacker would use libxmljs.parseXml() to parse a malicious XML document. Then, by traversing the document, for example with Document.get() and Element.childNodes(), they can obtain a reference to a vulnerable node object. Accessing the _ref property on this object, even implicitly via console.log(), triggers the crash. The identified functions are the JavaScript API surface that enables the exploit.
parseXmllibxmljs
Document.getlibxmljs
Element.childNodeslibxmljs
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| libxmljs | npm | <= 1.0.11 |