@cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability
Priority HIGH 70CWE-611Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
The CycloneDX JavaScript library contains the core functionality of OWASP CycloneDX for JavaScript. In 6.7.0, XML External entity injections were possible, when running the provided XML Validator on arbitrary input. This issue was fixed in version 6.7.1.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00925 60th percentileScored 2026-11-07
Fix Fixed @cyclonedx/cyclonedx-library (npm): 6.7.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| CycloneDX | cyclonedx-javascript-library | = 6.7.0 | — | No fix listed | CNA |
| — | @cyclonedx/cyclonedx-library (npm) | 6.7.0 to before 6.7.1 | 6.7.1 | Patch available | GHSA-38gf-rh2w-gmj7 |
- cyclonedx-javascript-library VendorCycloneDX Affected = 6.7.0 Fixed in — No fix listed CNA
- @cyclonedx/cyclonedx-library (npm) Vendor— Affected 6.7.0 to before 6.7.1 Fixed in 6.7.1 Patch available GHSA-38gf-rh2w-gmj7
Remediation
- Fix · GHSA-38gf-rh2w-gmj7 @cyclonedx/cyclonedx-library (npm) Fixed in 6.7.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-34345
- 2026-10-03 Alias added: GHSA-38gf-rh2w-gmj7
References
Other 4
- https://github.com/CycloneDX/cyclonedx-javascript-library/security/advisories/GHSA-38gf-rh2w-gmj7
- https://github.com/CycloneDX/cyclonedx-javascript-library/pull/1063
- https://github.com/CycloneDX/cyclonedx-javascript-library/commit/5e5e1e0b9422f47d2de81c7c4064b803a01e7203
- https://github.com/CycloneDX/cyclonedx-javascript-library
More CycloneDX vulnerabilities
- TI-2024-25631 Improper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-java CVSS 3.1HIGH 7.5
- TI-2025-39908 CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection CVSS 3.1HIGH 7.5
- TI-2026-50119 @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows CVSS 4.0HIGH 8.5
- TI-2026-40311 @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized `--workspace` Argument CVSS 4.0HIGH 8.5
- TI-2022-08588 Improper Input Validation leading to Path Traversal in CycloneDX BOM Repository Server CVSS 3.1HIGH 8.1
Sources
- CVE-2024-34345 · CVE Program
- CVE-2024-34345 · NVD
- FIRST EPSS
- GHSA-38gf-rh2w-gmj7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences