CVE-2024-34391

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-34391
libxmljs is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking a function on the result of attrs() that was called on a parsed node. This vulnerability might lead to denial of service (on both 32-bit systems and 64-bit systems), data leak, infinite loop and remote code execution (on 32-bit systems with the XML_PARSE_HUGE flag enabled).

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/libxmljs/libxmljs/issues/645 Exploit Issue Tracking
https://research.jfrog.com/vulnerabilities/libxmljs-attrs-type-confusion-rce-jfsa-2024-001033988/ Exploit Third Party Advisory
https://github.com/libxmljs/libxmljs/issues/645 Exploit Issue Tracking
https://research.jfrog.com/vulnerabilities/libxmljs-attrs-type-confusion-rce-jfsa-2024-001033988/ Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:libxmljs_project:libxmljs:*:*:*:*:*:node.js:*:*
History

10 Oct 2025, 18:20

Type Values Removed Values Added
First Time Libxmljs Project
Libxmljs Project libxmljs
CPE cpe:2.3:a:libxmljs_project:libxmljs:*:*:*:*:*:node.js:*:*
References () https://github.com/libxmljs/libxmljs/issues/645 - () https://github.com/libxmljs/libxmljs/issues/645 - Exploit, Issue Tracking
References () https://research.jfrog.com/vulnerabilities/libxmljs-attrs-type-confusion-rce-jfsa-2024-001033988/ - () https://research.jfrog.com/vulnerabilities/libxmljs-attrs-type-confusion-rce-jfsa-2024-001033988/ - Exploit, Third Party Advisory

25 Nov 2024, 13:15

Type Values Removed Values Added
Summary (en) libxmljs is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking a function on the result of attrs() that was called on a parsed node. This vulnerability might lead to denial of service (on both 32-bit systems and 64-bit systems), data leak, infinite loop and remote code execution (on 32-bit systems with the XML_PARSE_HUGE flag enabled). (en) libxmljs is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking a function on the result of attrs() that was called on a parsed node. This vulnerability might lead to denial of service (on both 32-bit systems and 64-bit systems), data leak, infinite loop and remote code execution (on 32-bit systems with the XML_PARSE_HUGE flag enabled).

21 Nov 2024, 09:18

Type Values Removed Values Added
References () https://github.com/libxmljs/libxmljs/issues/645 - () https://github.com/libxmljs/libxmljs/issues/645 -
References () https://research.jfrog.com/vulnerabilities/libxmljs-attrs-type-confusion-rce-jfsa-2024-001033988/ - () https://research.jfrog.com/vulnerabilities/libxmljs-attrs-type-confusion-rce-jfsa-2024-001033988/ -

06 Aug 2024, 16:35

Type Values Removed Values Added
CWE CWE-843

03 May 2024, 12:50

Type Values Removed Values Added
Summary
  • (es) libxmljs es afectada por una vulnerabilidad de confusión de tipos cuando se analiza un XML especialmente manipulado al invocar una función en el resultado de attrs() que se llamó en un nodo analizado. Esta vulnerabilidad podría provocar denegación de servicio (tanto en sistemas de 32 bits como en sistemas de 64 bits), fuga de datos, bucle infinito y ejecución remota de código (en sistemas de 32 bits con el indicador XML_PARSE_HUGE habilitado).

02 May 2024, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-02 19:15

Updated : 2025-10-10 18:20

NVD link : CVE-2024-34391

Mitre link : CVE-2024-34391

CVE.ORG link : CVE-2024-34391

JSON object : View

Products Affected

libxmljs_project

  • libxmljs
CWE
CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')