Skip to content
OpenAdvisories

Weakness (CWE)

CWE-91: XML Injection

Base Draft

The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

More detail

Within XML, special elements could include reserved words or characters such as "<", ">", """, and "&", which could then be used to add new data or modify XML syntax.

How to prevent it (1 mitigation)

  1. Implementation

    Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

    When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."

    Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.

Source: MITRE CWE-91

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 7.1
    CVE-2026-53582 Public exploit

    OPNsense: XPATH Injection can disclose any secret in config.xml

    OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate authority and certificate refid values and interpolates them into XPath expressions in src/opnsense/mvc/app/models/OPN…

    opnsense core
  • High 8.7
    CVE-2026-46490 Public exploit

    samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions

    samlify is a Node.js library for SAML single sign-on. Prior to version 2.13.0, samlify’s template substitution only escapes attribute contexts. Values inserted into element text (e.g., <saml:AttributeValue>) are not escaped. A normal user can inject XML marku…

    tngan samlify samlify npm
  • Medium 6.3
    CVE-2025-66034 Public exploit

    fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib

    fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 to before 4.60.2, the fonttools varLib (or python3 -m fontTools.varLib) script has an arbitrary file write vulnerability that leads to remote code execution when a malic…

    fonttools fonttools fonttools fonttools Debian Ubuntu PyPI
  • High 7.7
    CVE-2024-34740 Public exploit

    In attributeBytesBase64 and attributeBytesHex of BinaryXmlSerializer.java, there is a possible arbitrary XML injection …

    Google Android Android
  • High 8.0
    CVE-2023-46214 Public exploit EPSS 89%

    Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing

    In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means that an attacker can upload malicious XSLT which can result in remote code exec…

    Splunk Splunk Enterprise Splunk Cloud
  • High 7.2
    CVE-2019-25137 Public exploit

    Umbraco CMS 4.11.8 through 7.15.10, and 7.12.4, allows Remote Code Execution by authenticated administrators via msxsl:…

  • Critical 9.8
    CVE-2020-0646 Exploited Public exploit EPSS 99%

    A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.…

    Microsoft Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.5 Microsoft .NET Framework 3.5.1 Windows
    KEV Nov 3, 2021
  • High 8.8
    CVE-2018-19277 Public exploit

    XXE in PHPSpreadsheet due to encoding issue

    securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file

    phpoffice/phpspreadsheet phpoffice/phpexcel Packagist