AIKIDO-2025-10418

TL;DR

Affected versions of this package are vulnerable to memory corruption due to a use-after-free error stemming from the unsafe conversion of Swift strings to temporary C buffers during XML parsing. By passing temporary cString pointers to xmlReadDoc(), heap memory can be deallocated before finishing parsing. An attacker could exploit this issue by sending multiple large XML/HTML payloads, causing crashes, or through targeted memory grooming to leak sensitive data, like authentication tokens from freed memory.