xmlquery lacks check for whether LoadURL response is in XML format, causing denial of service

CRITICAL 9.8CVE-2020-25614 · GHSA-93m7-c69f-5cfj · GO-2020-0048 · Published 16/09/2020 · updated 17/06/2026

In short

CVE-2020-25614 is a CRITICAL (CVSS 9.8) vulnerability affecting github.com/antchfx/xmlquery, xmlquery (xmlquery project).
Chance of exploitation in the next 30 days (EPSS): 1.9%, higher than 80.2% of all vulnerabilities.
Fix: update to 1.3.1 or later.

Package	Affected versions	Patched versions
github.com/antchfx/xmlquery Go	`< 1.3.1`	`1.3.1`
xmlquery xmlquery_project	`< 1.3.1`	`1.3.1`

Description

xmlquery before 1.3.1 lacks a check for whether a LoadURL response is in the XML format, which allows attackers to cause a denial of service (SIGSEGV) at xmlquery.(*Node).InnerText or possibly have unspecified other impact.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2020-25614 · ADVISORY
antchfx/xmlquery · WEB
antchfx/xmlquery commit 5648b2f · WEB
antchfx/xmlquery · PACKAGE
antchfx/xmlquery · WEB
pkg.go.dev/vuln/GO-2020-0048 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free