Skip to content
OpenAdvisories

Weakness (CWE)

CWE-643: Improper Neutralization of Data within XPath Expressions

Base Incomplete

The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input.

How to prevent it (2 mitigations)

  1. Implementation

    Use parameterized XPath queries (e.g. using XQuery). This will help ensure separation between data plane and control plane.

  2. Implementation

    Properly validate user input. Reject data where appropriate, filter where appropriate and escape where appropriate. Make sure input that will be used in XPath queries is safe in that context.

Source: MITRE CWE-643

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.1
    CVE-2026-53582 Public exploit

    OPNsense: XPATH Injection can disclose any secret in config.xml

    OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPN…

    opnsense core
  • Medium 5.4
    CVE-2025-11844 Public exploit

    XPath Injection in Hugging Face Smolagents search_item_ctrl_f Function

    Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browser.py. The function constructs an XPath query by directly concatenating user-supplied input into the …

    huggingface huggingface/smolagents smolagents PyPI