AIKIDO-2025-10732

TL;DR

Several vulnerabilities were found and fixed in the sitemap library. The update introduces comprehensive input validation, centralized security limits, and enhanced XML sanitization to prevent cross-site scripting via malformed attributes. It adds strict URL, numeric, and date validation to mitigate injection and denial-of-service risks, blocks protocol and path traversal attacks, and enforces limits on sitemap size and resource counts. Additional fixes include prevention of command injection in xmllint, stricter hostname and namespace validation in streams, and improvements to number and date handling across utilities.