vetkit.js.xxe.libxml-noent
XML is parsed with libxmljs and noent: true, which expands external entities. A crafted document can read local files or make the server issue requests (XXE).
Last updated:
Suite: Security
javascript, typescript
XML is parsed with libxmljs and noent: true, which expands external entities. A crafted document can read local files or make the server issue requests (XXE).
Category: SECURITY · Engine rule severity: ERROR
How to fix it
Remove noent: true (entity expansion is off by default) and reject documents that contain a DOCTYPE.
References
Source: packages/engine/rules/sast/javascript.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.