CVE-2025-1781 — W3C / CSS Validator

CVE-2025-1781

W3C / CSS Validator PUBLISHED

Description (CNA)

There is a XXE in W3CSS Validator versions before cssval-20250226 that allows an attacker to use specially-crafted XML objects to coerce server-side request forgery (SSRF). This could be exploited to read arbitrary local files if an attacker has access to exception messages.

Affected (CNA)

Vendor / product	Versions
W3C / CSS Validator	affected < cssval-20250226

CWE

CWE-611

References

https://github.com/google/security-research/security/advisories/GHSA-745m-xmq6-g6x7

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.