Skip to content
OpenAdvisories
Critical · 9.1 CVE-2022-0671 EUVD-2022-0826GHSA-52vv-3vf7-f7wh

Server-Side Request Forgery and Uncontrolled Resource Consumption in LemMinX

Published Feb 18, 2022 · Updated Aug 2, 2024 · Assigned by redhat

Package: org.eclipse.lemminx:lemminx-parent Ecosystem: Maven

Description

A flaw was found in vscode-xml in versions prior to 0.19.0. Schema download could lead to blind SSRF or DoS via a large file.

Affected products

VendorProductAffectedFixed
— vscode-xml vscode-xml versions prior to 0.19.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.eclipse.lemminx:lemminx-parent < 0.19.0 0.19.0 GHSA-52vv-3vf7-f7wh

References