CVE-2024-34394: libxmljs2 RCE Vulnerability

CVE-2024-34394 Overview

CVE-2024-34394 is a type confusion vulnerability [CWE-843] in libxmljs2, a Node.js library for parsing XML documents. The flaw triggers when an application invokes the namespaces() function on a grand-child of a node that references an XML entity. This function internally calls XmlNode::get_local_namespaces(), which misinterprets the object type during parsing of a crafted XML document. Successful exploitation can lead to denial of service or remote code execution in Node.js applications that consume untrusted XML input through libxmljs2.

Critical Impact
Attackers delivering crafted XML to applications that call namespaces() on entity-referenced nodes can trigger denial of service or remote code execution.

Affected Products

libxmljs2 (Node.js XML parsing library maintained by marudor)
Node.js applications that parse untrusted XML using libxmljs2
Downstream packages depending on libxmljs2 for XML processing

Discovery Timeline

2024-05-02 - CVE-2024-34394 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-34394

Vulnerability Analysis

The vulnerability resides in libxmljs2's handling of XML namespace enumeration. When an application calls namespaces() on an XML node, the library traverses descendants and invokes XmlNode::get_local_namespaces() to collect namespace declarations. The function assumes the underlying node is a standard element node. A crafted XML document containing an entity reference can place a node of an unexpected type as a grand-child of the target node.

When the parser walks into this grand-child during namespace collection, it casts or dereferences the node as if it were the expected element type. This type confusion [CWE-843] causes the code to access memory using an incorrect structure layout. The result is memory corruption that an attacker can shape to cause a crash or to redirect execution flow.

Root Cause

The root cause is missing type validation in XmlNode::get_local_namespaces() before dereferencing nodes reached through entity expansion. The parser does not verify the node kind returned by libxml2 internals when entities are resolved, allowing nodes of mismatched types to enter code paths that assume element semantics.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker submits a malicious XML document to any application endpoint that parses XML with libxmljs2 and subsequently calls namespaces() on nodes derived from the input. The malicious document defines an entity whose expansion produces a node arrangement triggering the type confusion. Exploitation complexity is high because the attacker must control memory layout to achieve code execution beyond a crash. Refer to the JFrog Vulnerability Report and the GitHub Issue Report for technical analysis.

Detection Methods for CVE-2024-34394

Indicators of Compromise

Unexpected crashes or segmentation faults in Node.js processes that parse XML with libxmljs2.
XML payloads in application logs containing <!ENTITY> declarations followed by nested element references.
Anomalous child process spawns originating from Node.js workers handling XML input.

Detection Strategies

Inventory Node.js dependencies using npm ls libxmljs2 to identify affected services across the environment.
Inspect application code for calls to namespaces() on nodes derived from external XML and flag these as exposed sinks.
Apply web application firewall rules that block XML payloads containing entity declarations with deeply nested child structures.

Monitoring Recommendations

Monitor Node.js process stability and memory faults on services that ingest XML from untrusted sources.
Log XML parsing errors with payload hashes to support post-incident analysis and threat hunting.
Track outbound network connections from XML-processing services to identify post-exploitation activity.

How to Mitigate CVE-2024-34394

Immediate Actions Required

Identify all applications that depend on libxmljs2 and prioritize those that parse XML from external sources.
Upgrade libxmljs2 to a fixed release as published by the maintainer, or migrate to an alternative XML parser if no patch is available.
Disable or remove calls to namespaces() on nodes derived from untrusted XML until patching completes.

Patch Information

Review the project's GitHub Issue Report for maintainer guidance on remediation status. The JFrog Vulnerability Report provides additional detail on affected versions and recommended fixes. Where no patched release is available, isolate or replace the affected component.

Workarounds

Reject XML documents containing DOCTYPE declarations or external entity definitions at the application boundary.
Pre-validate XML against a strict schema before invoking libxmljs2 traversal functions.
Run XML parsing in an isolated worker process with reduced privileges so that exploitation cannot reach the main application context.

bash

# Configuration example: audit and remove libxmljs2 usage
npm ls libxmljs2
npm uninstall libxmljs2
npm install <alternative-xml-parser>