-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| xml2rfc | pip | >= 3.12.0, < 3.27.0 | 3.27.0 |
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability stems from three key areas:
templates_dir for XML entity includes.New behaviour:
| | xinclude | XML entity reference | artwork src= | sourcecode src= |
|---|---|---|---|---|
| without --allow-local-file-access flag | No filesystem access | No filesystem access (except for templates_dir) | No filesystem access | No filesystem access |
| with --allow-local-file-access flag | Access source directory and below | Access source directory and below (Can accesstemplates_dir). | Access source directory and below | Access source directory and below |
Use a secure temporary directory to process un-trusted XML files, and do not reuse it for processing other XML documents.
Ongoing coverage of React2Shell