GHSA-2g98-f9jv-w8c5

robrichards/xmlseclibs XPath injection

7.5 HighFix available

GHSA-2g98-f9jv-w8c5 is a high vulnerability (CVSS 7.5) in robrichards/xmlseclibs, published May 20, 2024. No source lists public exploit code. Fixed in robrichards/xmlseclibs 3.0.2.

What does this mean?

Severity: 7.5 HighCVSS 3.1, GitHub Advisories
Exploit chance: UnscoredNo EPSS score yet
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 3.0.2robrichards/xmlseclibs +1 more

Description

A vulnerability has been identified in the robrichards/xmlseclibs library, specifically related to XPath injection. The issue arises from inadequate filtering of user input before it is incorporated into XPath expressions.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Affected packages

Affected packages
Package	Affected	Fixed
`robrichards/xmlseclibs` Packagist	1.0.0 up to 3.0.2	3.0.2
`robrichards/xmlseclibs` Packagist	1.0.0 up to 3.0.2, plus listed versions 1.3.21.3.31.3.41.4.01.4.1 Show 8 moreShow less 1.4.21.4.32.0.02.0.12.1.02.1.13.0.03.0.1	3.0.2

What each source reports

GitHub Advisories Score used7.5

robrichards/xmlseclibs XPath injection

Record: GHSA-2g98-f9jv-w8c5
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-91
Updated: 2026-11-02

OSV7.5