CWE-115
AllowedMisinterpretation of Input
Abstraction: Base · Status: Incomplete
The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.
52 vulnerabilities reference this CWE, most recent first.
GHSA-H6Q6-9HQW-RWFV
Vulnerability from github – Published: 2021-03-12 22:39 – Updated: 2023-01-02 21:51Impact
xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents.
This may lead to unexpected syntactic changes during XML processing in some downstream applications.
Patches
Update to 0.5.0 (once it is released)
Workarounds
Downstream applications can validate the input and reject the maliciously crafted documents.
References
Similar to this one reported on the Go standard library:
- https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/
For more information
If you have any questions or comments about this advisory:
- Open an issue in
xmldom/xmldom - Email us: send an email to all addresses that are shown by
npm owner ls xmldom
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "xmldom"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-21366"
],
"database_specific": {
"cwe_ids": [
"CWE-115",
"CWE-436"
],
"github_reviewed": true,
"github_reviewed_at": "2021-03-12T16:21:24Z",
"nvd_published_at": "2021-03-12T17:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nxmldom versions 0.4.0 and older do not correctly preserve [system identifiers](https://www.w3.org/TR/2008/REC-xml-20081126/#d0e4313), [FPIs](https://en.wikipedia.org/wiki/Formal_Public_Identifier) or [namespaces](https://www.w3.org/TR/xml-names11/) when repeatedly parsing and serializing maliciously crafted documents.\n\nThis may lead to unexpected syntactic changes during XML processing in some downstream applications.\n\n### Patches\n\nUpdate to 0.5.0 (once it is released)\n\n### Workarounds\n\nDownstream applications can validate the input and reject the maliciously crafted documents.\n\n### References\n\nSimilar to this one reported on the Go standard library:\n\n- https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [`xmldom/xmldom`](https://github.com/xmldom/xmldom)\n* Email us: send an email to **all** addresses that are shown by `npm owner ls xmldom`",
"id": "GHSA-h6q6-9hqw-rwfv",
"modified": "2023-01-02T21:51:19Z",
"published": "2021-03-12T22:39:39Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-h6q6-9hqw-rwfv"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21366"
},
{
"type": "WEB",
"url": "https://github.com/xmldom/xmldom/commit/d4201b9dfbf760049f457f9f08a3888d48835135"
},
{
"type": "PACKAGE",
"url": "https://github.com/xmldom/xmldom"
},
{
"type": "WEB",
"url": "https://github.com/xmldom/xmldom/releases/tag/0.5.0"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00000.html"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/package/xmldom"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Misinterpretation of malicious XML input"
}
GHSA-PQW5-JMP5-PX4V
Vulnerability from github – Published: 2022-09-16 00:00 – Updated: 2022-09-19 20:25parse-url prior to 8.1.0 is vulnerable to Misinterpretation of Input. parse-url parses certain http or https URLs incorrectly, identifying the URL's protocol as ssh. It may also parse the host name incorrectly.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "parse-url"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-3224"
],
"database_specific": {
"cwe_ids": [
"CWE-115"
],
"github_reviewed": true,
"github_reviewed_at": "2022-09-16T21:21:19Z",
"nvd_published_at": "2022-09-15T12:15:00Z",
"severity": "MODERATE"
},
"details": "parse-url prior to 8.1.0 is vulnerable to Misinterpretation of Input. parse-url parses certain http or https URLs incorrectly, identifying the URL\u0027s protocol as ssh. It may also parse the host name incorrectly.",
"id": "GHSA-pqw5-jmp5-px4v",
"modified": "2022-09-19T20:25:17Z",
"published": "2022-09-16T00:00:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3224"
},
{
"type": "WEB",
"url": "https://github.com/ionicabizau/parse-url/commit/9cacf38de02db0fb1358bd6ec04543e523cd6a8e"
},
{
"type": "PACKAGE",
"url": "https://github.com/ionicabizau/parse-url"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/3587a567-7fcd-4702-b7c9-d9ca565e3c62"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "parse-url parses http URLs incorrectly, making it vulnerable to host name spoofing"
}
GHSA-Q4QQ-C3QM-82JJ
Vulnerability from github – Published: 2026-06-25 15:31 – Updated: 2026-06-25 15:31An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted, causing the backend to see the EDNS option(s) that DNSdist did not filter.
{
"affected": [],
"aliases": [
"CVE-2026-42004"
],
"database_specific": {
"cwe_ids": [
"CWE-115"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-25T13:16:40Z",
"severity": "LOW"
},
"details": "An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist\u2019s filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted, causing the backend to see the EDNS option(s) that DNSdist did not filter.",
"id": "GHSA-q4qq-c3qm-82jj",
"modified": "2026-06-25T15:31:59Z",
"published": "2026-06-25T15:31:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42004"
},
{
"type": "WEB",
"url": "https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-09.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QXP5-GWG8-XV66
Vulnerability from github – Published: 2025-03-12 22:06 – Updated: 2026-04-24 20:36Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to "*.example.com", a request to "[::1%25.example.com]:80` will incorrectly match and not be proxied.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "golang.org/x/net"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.36.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-22870"
],
"database_specific": {
"cwe_ids": [
"CWE-115",
"CWE-20"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-12T22:06:40Z",
"nvd_published_at": "2025-03-12T19:15:38Z",
"severity": "MODERATE"
},
"details": "Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component. For example, when the NO_PROXY environment variable is set to \"*.example.com\", a request to \"[::1%25.example.com]:80` will incorrectly match and not be proxied.",
"id": "GHSA-qxp5-gwg8-xv66",
"modified": "2026-04-24T20:36:12Z",
"published": "2025-03-12T22:06:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22870"
},
{
"type": "PACKAGE",
"url": "https://go-review.googlesource.com/q/project:net"
},
{
"type": "WEB",
"url": "https://go.dev/cl/654697"
},
{
"type": "WEB",
"url": "https://go.dev/issue/71984"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/golang-announce/c/4t3lzH3I0eI/m/b42ImqrBAQAJ"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2025-3503"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20250509-0007"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/03/07/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/net"
}
GHSA-VC49-QC4G-2225
Vulnerability from github – Published: 2024-04-11 09:30 – Updated: 2024-04-11 09:30A firmware bug which may lead to misinterpretation of data in the AMC2-4WCF and AMC2-2WCF allowing an adversary to grant access to the last authorized user.
{
"affected": [],
"aliases": [
"CVE-2023-32228"
],
"database_specific": {
"cwe_ids": [
"CWE-115"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-11T09:15:07Z",
"severity": "MODERATE"
},
"details": "A firmware bug which may lead to misinterpretation of data in the AMC2-4WCF and AMC2-2WCF allowing an adversary to grant access to the last authorized user.",
"id": "GHSA-vc49-qc4g-2225",
"modified": "2024-04-11T09:30:56Z",
"published": "2024-04-11T09:30:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32228"
},
{
"type": "WEB",
"url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-391095-BT.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VFFC-QPX3-764C
Vulnerability from github – Published: 2025-03-20 12:32 – Updated: 2025-03-20 12:32A vulnerability in binary-husky/gpt_academic version 310122f allows for a Regular Expression Denial of Service (ReDoS) attack. The application uses a regular expression to parse user input, which can take polynomial time to match certain crafted inputs. This allows an attacker to send a small malicious payload to the server, causing it to become unresponsive and unable to handle any requests from other users.
{
"affected": [],
"aliases": [
"CVE-2024-12388"
],
"database_specific": {
"cwe_ids": [
"CWE-115",
"CWE-1333"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-20T10:15:28Z",
"severity": "MODERATE"
},
"details": "A vulnerability in binary-husky/gpt_academic version 310122f allows for a Regular Expression Denial of Service (ReDoS) attack. The application uses a regular expression to parse user input, which can take polynomial time to match certain crafted inputs. This allows an attacker to send a small malicious payload to the server, causing it to become unresponsive and unable to handle any requests from other users.",
"id": "GHSA-vffc-qpx3-764c",
"modified": "2025-03-20T12:32:43Z",
"published": "2025-03-20T12:32:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12388"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/b1c01c94-e477-41db-9d17-601aa25e351c"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W6HH-W36C-VXMW
Vulnerability from github – Published: 2025-03-20 12:32 – Updated: 2025-03-21 03:39mudler/localai version v2.21.1 contains a Cross-Site Scripting (XSS) vulnerability in its search functionality. The vulnerability arises due to improper sanitization of user input, allowing the injection and execution of arbitrary JavaScript code. This can lead to the execution of malicious scripts in the context of the victim's browser, potentially compromising user sessions, stealing session cookies, redirecting users to malicious websites, or manipulating the DOM.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/mudler/LocalAI"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.22.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-9900"
],
"database_specific": {
"cwe_ids": [
"CWE-115",
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-21T03:39:10Z",
"nvd_published_at": "2025-03-20T10:15:50Z",
"severity": "MODERATE"
},
"details": "mudler/localai version v2.21.1 contains a Cross-Site Scripting (XSS) vulnerability in its search functionality. The vulnerability arises due to improper sanitization of user input, allowing the injection and execution of arbitrary JavaScript code. This can lead to the execution of malicious scripts in the context of the victim\u0027s browser, potentially compromising user sessions, stealing session cookies, redirecting users to malicious websites, or manipulating the DOM.",
"id": "GHSA-w6hh-w36c-vxmw",
"modified": "2025-03-21T03:39:11Z",
"published": "2025-03-20T12:32:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9900"
},
{
"type": "WEB",
"url": "https://github.com/mudler/localai/commit/a1634b219a4e52813e70ff07e6376a01449c4515"
},
{
"type": "PACKAGE",
"url": "https://github.com/mudler/LocalAI"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/b39cd230-db66-471b-89b9-24afaa078e68"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "LocalAI Cross-Site Scripting (XSS) vulnerability in its search functionality"
}
GHSA-WXQ6-7GFP-QPJ4
Vulnerability from github – Published: 2025-06-26 21:31 – Updated: 2025-06-26 21:31Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability. This vulnerability allows network-adjacent attackers to inject arbitrary AT commands on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the ble_process_esp32_msg function. The issue results from misinterpretation of input data. An attacker can leverage this vulnerability to execute AT commands in the context of the device. Was ZDI-CAN-26368.
{
"affected": [],
"aliases": [
"CVE-2025-5826"
],
"database_specific": {
"cwe_ids": [
"CWE-115"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-25T18:15:23Z",
"severity": "MODERATE"
},
"details": "Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability. This vulnerability allows network-adjacent attackers to inject arbitrary AT commands on affected installations of Autel MaxiCharger AC Wallbox Commercial charging stations. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the ble_process_esp32_msg function. The issue results from misinterpretation of input data. An attacker can leverage this vulnerability to execute AT commands in the context of the device. Was ZDI-CAN-26368.",
"id": "GHSA-wxq6-7gfp-qpj4",
"modified": "2025-06-26T21:31:13Z",
"published": "2025-06-26T21:31:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5826"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-345"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-X34V-HHV2-P545
Vulnerability from github – Published: 2025-06-06 18:30 – Updated: 2025-06-06 18:30WOLFBOX Level 2 EV Charger MCU Command Parsing Misinterpretation of Input Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installatons of WOLFBOX Level 2 EV Charger devices. Authentication is required to exploit this vulnerability.
The specific flaw exists within the handling of command frames received by the MCU. When parsing frames, the process does not properly detect the start of a frame, which can lead to misinterpretation of input. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the device. Was ZDI-CAN-26501.
{
"affected": [],
"aliases": [
"CVE-2025-5747"
],
"database_specific": {
"cwe_ids": [
"CWE-115"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-06T16:15:29Z",
"severity": "HIGH"
},
"details": "WOLFBOX Level 2 EV Charger MCU Command Parsing Misinterpretation of Input Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installatons of WOLFBOX Level 2 EV Charger devices. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of command frames received by the MCU. When parsing frames, the process does not properly detect the start of a frame, which can lead to misinterpretation of input. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the device. Was ZDI-CAN-26501.",
"id": "GHSA-x34v-hhv2-p545",
"modified": "2025-06-06T18:30:32Z",
"published": "2025-06-06T18:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5747"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-326"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-X8XR-MJ9X-6H7W
Vulnerability from github – Published: 2026-06-17 18:35 – Updated: 2026-06-18 14:31Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-8jr5-v98p-w75m. This link is maintained to preserve external references.
Original Description
A flaw was found in vLLM, an open-source library for large language model inference. This vulnerability arises from improper handling of image metadata, specifically EXIF orientation and PNG transparency (tRNS) data, during image processing. When images are converted to RGB, transparency information may be implicitly discarded or remapped, leading to unexpected rendering of transparent pixels and distortion of input content. This can result in the model misinterpreting image content, potentially affecting the integrity of processed data.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "vllm"
},
"ranges": [
{
"events": [
{
"introduced": "0.11.0"
},
{
"last_affected": "0.23.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-115"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-18T14:31:36Z",
"nvd_published_at": "2026-06-17T13:20:04Z",
"severity": "MODERATE"
},
"details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-8jr5-v98p-w75m. This link is maintained to preserve external references.\n\n## Original Description\nA flaw was found in vLLM, an open-source library for large language model inference. This vulnerability arises from improper handling of image metadata, specifically EXIF orientation and PNG transparency (tRNS) data, during image processing. When images are converted to RGB, transparency information may be implicitly discarded or remapped, leading to unexpected rendering of transparent pixels and distortion of input content. This can result in the model misinterpreting image content, potentially affecting the integrity of processed data.",
"id": "GHSA-x8xr-mj9x-6h7w",
"modified": "2026-06-18T14:31:36Z",
"published": "2026-06-17T18:35:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12491"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-12491"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489786"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Duplicate Advisory: image EXIF Rotation \u0026 PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations",
"withdrawn": "2026-06-18T14:31:36Z"
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.