AIKIDO-2026-148258
robrichards/xmlseclibs is vulnerable to XML External Entity (XXE) Injection
59
Medium Risk
This Affects:
robrichards/xmlseclibsTL;DR
XMLSecEnc::decryptNode() parses decrypted plaintext by calling loadXML() on a new DOMDocument without disabling external entity processing. On PHP earlier than 8.0, where external-entity loading is enabled by default, content that decrypts to a DOCTYPE/XXE payload can trigger server-side file reads and outbound requests, which is reachable when the encryption public key is published as in SAML. This can disclose local files and internal services. The fix routes decrypted XML through a hardened parser that sets LIBXML_NONET and rejects any DOCTYPE.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range, you run the library on PHP earlier than 8.0, and you decrypt XML from untrusted sources.
Background info
robrichards/xmlseclibs is vulnerable to XML External Entity (XXE) Injection in versions 0.0.1 - 3.1.5.
How to fix this
Upgrade the robrichards/xmlseclibs library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.