AIKIDO-2026-10869
symfony/dom-crawler is vulnerable to XML External Entity (XXE)
37
Low Risk
This Affects:
symfony/dom-crawlerTL;DR
Crawler::addXmlContent() enables DOMDocument::validateOnParse before loading XML. That setting can re-enable external entity resolution for local file URLs even when network loading is disabled. Pre-fix parsing of attacker-controlled XML can disclose local file contents through expanded entities. The fix stops enabling validation during XML parsing.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
symfony/dom-crawler is vulnerable to XML External Entity (XXE) in versions 0.0.1 - 5.4.51, 6.0.0 - 6.4.39, 7.0.0 - 7.4.11 and 8.0.0 - 8.0.11.
How to fix this
Upgrade the symfony/dom-crawler and/or symfony/symfony library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant