Is CVE-2025-25341 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-25341 being exploited in the wild.

How severe is CVE-2025-25341?

High severity, with a CVSS score of 7.5, published 26 December 2025.

Which products and versions are affected?

libxmljs (npm) SEMVER:introduced=0,last_affected=1.0.11.

Is there a fix for CVE-2025-25341?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-25341 attacked?

It is attacked over the network.

Am I affected by CVE-2025-25341?

Check whether you run Libxmljs Project Libxmljs or libxmljs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-25341: libxmljs segmentation fault in entity node parsing

CVE-2025-25341 · Severity: high · CVSS 7.5 · Published 2025-12-26

libxmljs is a Node.js library used to parse and manipulate XML documents. A vulnerability allows attackers to crash applications that use this library by triggering a segmentation fault when parsing specially crafted XML files containing entity declarations. This denial-of-service attack requires only a malicious XML file and results in complete service unavailability.

Technologies: libxmljs (npm). Vendors: npm.

Quick answers

Is CVE-2025-25341 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-25341 being exploited in the wild.
How severe is CVE-2025-25341?: High severity, with a CVSS score of 7.5, published 26 December 2025.
Which products and versions are affected?: libxmljs (npm) SEMVER:introduced=0,last_affected=1.0.11.
Is there a fix for CVE-2025-25341?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-25341 attacked?: It is attacked over the network.
Am I affected by CVE-2025-25341?: Check whether you run Libxmljs Project Libxmljs or libxmljs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a segmentation fault (CWE-400: Uncontrolled Resource Consumption) in libxmljs version 1.0.11 that occurs when accessing the internal _ref property on entity_ref and entity_decl nodes after parsing a specially crafted XML document. The root cause stems from improper handling of XML entity references—when an attacker provides an XML file with entity declarations and the application accesses the _ref property directly (either via property access, console.log, or Object.getOwnPropertyNames), the library dereferences an invalid pointer, causing the process to crash. The attack requires only network/file access to provide a malicious XML document (no authentication or user interaction needed) and affects all versions up to and including 1.0.11. The impact is denial of service through application crash; potential for further memory corruption and data leakage has been noted but not demonstrated.

Affected products

libxmljs libxmljs up to and including 1.0.11

Identifiers

CVE-2025-25341
GHSA-jv72-59wq-8rxm

Timeline

2025-01-09: disclosed: Issue reported on GitHub
2025-12-26: advisory: Security advisory published

References

https://github.com/libxmljs/libxmljs/issues/667

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.