This page collects WhisperX intelligence signals tagged #XML parsing. It is designed for humans, search engines, and AI agents: each item links to a canonical source-backed record with sector, source, timestamp, credibility, and exportable structured data.
lxml 库发布 6.1.0 版本，核心更新是修复了一个存在于 `iterparse()` 函数和 `ETCompatXMLParser` 解析器中的潜在外部实体注入（XXE）漏洞。该漏洞编号为 LP#2146291，其根源在于这两个组件的 `resolve_entities` 选项仍被错误地设置为 `True`，可能导致恶意构造的 XML 文档被解析时，触发对不安全外部资源的访问或数据泄露。对于依赖 lxml 处理用户可控 XML 输入的应用，此漏洞构成直接的安全风险。 此次更新是 lxml 项目自 6.0.4 版本以来的首个次要版本发布。除了关键的安全修复，新版本还引入了两项功能：一是将 HTML ARIA 无障碍访问属性添加...
A critical security vulnerability has been identified in libxmljs2, a widely-used Node.js library for XML parsing, exposing applications to type confusion attacks when processing specially crafted XML documents. The flaw, classified as CWE-843, carries a CVSS severity score of 8.1, placing it in the high-criticality ra...