AIKIDO-2025-10418
Kanna is vulnerable to Use-After-Free
71
High Risk
This Affects:
KannaTL;DR
Affected versions of this package are vulnerable to memory corruption due to a use-after-free error stemming from the unsafe conversion of Swift strings to temporary C buffers during XML parsing. By passing temporary cString pointers to xmlReadDoc(), heap memory can be deallocated before finishing parsing. An attacker could exploit this issue by sending multiple large XML/HTML payloads, causing crashes, or through targeted memory grooming to leak sensitive data, like authentication tokens from freed memory.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
Kanna is vulnerable to Use-After-Free in versions 4.0.0 - 6.0.0.
How to fix this
Upgrade the Kanna library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant