AIKIDO-2026-10301

TL;DR

Affected versions of this package contain a type confusion vulnerability when parsing specially crafted XML and invoking the namespaces() function on a grand-child node that references an entity. The underlying _wrap__xmlNode_nsDef_get() call may incorrectly interpret memory structures, leading to memory corruption. An attacker could provide a malicious XML payload that triggers this condition during parsing, potentially causing denial of service or remote code execution if memory corruption is exploited. Notably, this issue has remained open for years and the package appears to be unmaintained or no longer actively updated, which increases the risk of continued exposure.