CVE-2024-34392: Libxmljs Project Libxmljs

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

libxmljs is vulnerable to a type confusion vulnerability when parsing a specially crafted XML while invoking the namespaces() function (which invokes _wrap__xmlNode_nsDef_get()) on a grand-child of a node that refers to an entity. This vulnerability can lead to denial of service and remote code execution.

Affected products

• Libxmljs Project Libxmljs: before 1.0.11 (fixed in 1.0.11)

Published 2024-05-02. Last modified 2026-06-17.