CVE-2020-25614: Xmlquery Project Xmlquery

Critical severity, CVSS 9.8. EPSS: 1.9% chance of exploitation in the next 30 days.

xmlquery before 1.3.1 lacks a check for whether a LoadURL response is in the XML format, which allows attackers to cause a denial of service (SIGSEGV) at xmlquery.(*Node).InnerText or possibly have unspecified other impact.

Affected products

• Xmlquery Project Xmlquery: before 1.3.1 (fixed in 1.3.1)

Published 2020-09-16. Last modified 2026-06-17.