xml-security
Safeguard articles tagged "xml-security" — guides, analysis, and best practices for software supply chain and application security.
15 articles
Finding and fixing XXE vulnerabilities across common XML parsers
XXE is tracked as CWE-611 and lives in OWASP's misconfiguration category — because most XML parsers ship unsafe by default.
XPath injection: how it happens and how to stop it in Java, .NET, and PHP
A 2024 GeoServer flaw showed unsanitized input reaching an XPath evaluator can mean remote code execution, not just data leakage. Here's how to prevent it.
Preventing XML external entity (XXE) injection
XXE injection lets attackers read local files, trigger SSRF, or crash servers via XML parsers. Here is how it works and how to shut it down for good.
What is XML External Entity (XXE) Injection
XXE injection lets attackers abuse XML parsers to read files, trigger SSRF, or crash services. Here's how it works, real CVEs, and how to stop it.
XPath Injection Vulnerabilities
XPath injection lets attackers rewrite XML queries to bypass logins and steal data. Here is how it works, real incidents, and how Safeguard defends against it.
XXE Prevention in Ruby with Nokogiri NONET/NOENT
Nokogiri wraps libxml2, and one misconfigured parse call can leak local files or trigger SSRF. Here's how NONET and NOENT actually work, and how to lock them down.
XXE Prevention in Python with resolve_entities=False
Why lxml's XMLParser resolves external entities by default, how resolve_entities=False actually stops XXE, and where Python teams still leave file-read and SSRF paths open.
Blind and Out-of-Band XXE: How XXE Injection Really Works
A defensive guide to XXE injection, including the blind and out-of-band variants that leak data with no visible response, plus how to detect and shut them down.
WWW XXE: Understanding and Preventing XML External Entity Attacks
XXE lets a crafted XML document read files, reach internal services, and exhaust resources. Here is how the attack works and how to shut it down.
XXE Example in Java: How the Attack Works and How to Stop It
A concrete XXE example in Java showing why default XML parsers are dangerous, what an attacker can read, and the exact parser configuration that shuts it down.
XXE Attack Example: How XML External Entity Injection Works and How to Stop It
A defensive XXE attack example that explains how XML External Entity injection abuses parsers, what it can expose, and the parser settings that shut it down.
CVE-2022-40152: Woodstox XML Parsing Denial of Service
CVE-2022-40152 lets malicious XML with deeply nested DTD content crash Woodstox-based parsers via stack overflow. Here is the root cause, affected versions, and how to remediate it.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.