High severity8.1OSV Advisory· Published May 14, 2024· Updated Apr 15, 2026
CVE-2024-34345
CVE-2024-34345
Description
The CycloneDX JavaScript library contains the core functionality of OWASP CycloneDX for JavaScript. In 6.7.0, XML External entity injections were possible, when running the provided XML Validator on arbitrary input. This issue was fixed in version 6.7.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
@cyclonedx/cyclonedx-librarynpm | >= 6.7.0, < 6.7.1 | 6.7.1 |
Affected products
2- Range: v1.0.0, v1.0.0-beta.2, v1.0.0-beta.3, …
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-38gf-rh2w-gmj7ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-34345ghsaADVISORY
- github.com/CycloneDX/cyclonedx-javascript-library/commit/5e5e1e0b9422f47d2de81c7c4064b803a01e7203nvdWEB
- github.com/CycloneDX/cyclonedx-javascript-library/pull/1063nvdWEB
- github.com/CycloneDX/cyclonedx-javascript-library/security/advisories/GHSA-38gf-rh2w-gmj7nvdWEB
News mentions
0No linked articles in our index yet.