CVE-2024-34391 — libxmljs attrs type confusion RCE
libxmljs is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking a function on the result of attrs() that was called on a parsed node…
Published: 2024-05-02 · CVSS: 8.1 · CVSS 3.1
libxmljs is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking a function on the result of attrs() that was called on a parsed node. This vulnerability might lead to denial of service (on both 32-bit systems and 64-bit systems), data leak, infinite loop and remote code execution (on 32-bit systems with the XML_PARSE_HUGE flag enabled).
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7