Skip to content
CVE PROGRAM SOURCE RECORD8.4 High

CVE-2025-1781

There is a XXE in W3CSS Validator versions before cssval-20250226 that allows an attacker to use specially-crafted XML objects to coerce server-side request forgery (SSRF).  This c

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Google

Description

There is a XXE in W3CSS Validator versions before cssval-20250226 that allows an attacker to use specially-crafted XML objects to coerce server-side request forgery (SSRF).  This could be exploited to read arbitrary local files if an attacker has access to exception messages.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

W3C CSS Validator

Default version status: unaffected

  • < cssval-20250226affected

References