HIGH7.5

GHSA-2g98-f9jv-w8c5

robrichards/xmlseclibs XPath injection

Quick fix

GHSA-2g98-f9jv-w8c5 — robrichards/xmlseclibs: upgrade to the fixed version with the command below.

composer require robrichards/xmlseclibs:^3.0.2

Details

A vulnerability has been identified in the robrichards/xmlseclibs library, specifically related to XPath injection. The issue arises from inadequate filtering of user input before it is incorporated into XPath expressions.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/robrichards/xmlseclibs

Introduced in: 1.0.0Fixed in: 3.0.2

Fixcomposer require robrichards/xmlseclibs:^3.0.2

References

https://github.com/robrichards/xmlseclibs/commit/649032643f7aac493e91ca318da0339aec72aa4a[WEB]
https://github.com/FriendsOfPHP/security-advisories/blob/master/robrichards/xmlseclibs/2018-09-27.yaml[WEB]
https://github.com/robrichards/xmlseclibs[PACKAGE]