CVE-2024-34393: 
JavaScript vulnerability analysis and mitigation

libxmljs2 was discovered to contain a type confusion vulnerability (CVE-2024-34393) when parsing specially crafted XML while invoking a function on the result of attrs() that was called on a parsed node. The vulnerability was disclosed on May 2, 2024, affecting the libxmljs2 package across multiple versions (JFrog Research).

The vulnerability is classified with a CVSS v3.1 base score of 8.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue stems from improper type handling during XML parsing operations, specifically when using the attrs() function on parsed nodes. The vulnerability is tracked under CWE-843 (Access of Resource Using Incompatible Type) (NVD).

The vulnerability can lead to multiple severe consequences including denial of service on both 32-bit and 64-bit systems, data leaks, infinite loops, and potential remote code execution specifically on 32-bit systems when the XML_PARSE_HUGE flag is enabled (JFrog Research).

The vulnerability can be exploited by providing specially crafted XML input to the application. A proof of concept exists demonstrating the vulnerability by using specific XML parsing operations with the XML_PARSE_HUGE flag enabled (JFrog Research).

As of the vulnerability disclosure, no specific mitigations have been provided for this issue (JFrog Research).