What’s Vulnerable › Vulnerabilities

CVE-2024-34345: @cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-14 · updated 2026-06-17
• Weakness: CWE-611

Description

The CycloneDX JavaScript library contains the core functionality of OWASP CycloneDX for JavaScript. In 6.7.0, XML External entity injections were possible, when running the provided XML Validator on arbitrary input. This issue was fixed in version 6.7.1.

Affected products

• cyclonedx-javascript-library: = 6.7.0

References

• https://github.com/CycloneDX/cyclonedx-javascript-library/commit/5e5e1e0b9422f47d2de81c7c4064b803a01e7203
• https://github.com/CycloneDX/cyclonedx-javascript-library/pull/1063
• https://github.com/CycloneDX/cyclonedx-javascript-library/security/advisories/GHSA-38gf-rh2w-gmj7
• https://github.com/CycloneDX/cyclonedx-javascript-library/commit/5e5e1e0b9422f47d2de81c7c4064b803a01e7203
• https://github.com/CycloneDX/cyclonedx-javascript-library/pull/1063
• https://github.com/CycloneDX/cyclonedx-javascript-library/security/advisories/GHSA-38gf-rh2w-gmj7

Get alerted when CVE-2024-34345 or the next vulnerability affects your stack