CVSS 3.0
9.8 criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2017-18197
Critical (9.8) in jgraph mxgraph. EPSS 2.9% chance of exploitation in the next 30 days. Fixed in mxgraph 3.7.6.
In mxGraphViewImageReader.java in mxGraph before 3.7.6, the SAXParserFactory instance in convert() is missing flags to prevent XML External Entity (XXE) attacks, as demonstrated by /ServerView.
Severity
- EPSS
- 2.9% chance of exploitation in the next 30 days; higher than 86% of CVEs (scores of 2026-10-31)
- CWE
- CWE-611
- Published
- Modified
- Record from
- the NVD, synced
Affected
- jgraph:mxgraph
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-wvpv-8524-wg6x | npm | mxgraph | <3.7.6 | 3.7.6 |