Security vulnerabilities and automated fixes for xml injection issues
2 posts found
A critical XML External Entity (XXE) vulnerability was discovered in `scripts/screenshots/ui.py` where the native Python `xml.etree.ElementTree` library was used without XXE protections. The fix replaces the vulnerable import with `defusedxml.ElementTree`, which disables external entity processing by default and prevents attackers from exploiting XML parsing to access sensitive files or execute denial-of-service attacks.
CVE-2026-41672 is a high-severity XML node injection vulnerability in the `@xmldom/xmldom` package, caused by insufficient validation during comment serialization that allows attackers to inject arbitrary XML nodes into a document. The fix upgrades `@xmldom/xmldom` from version 0.8.12 to 0.8.13 (and 0.9.x to 0.9.10), closing the injection path by tightening how untrusted comment content is handled before it reaches the serializer.