Junglewise Threat Intelligence

CVE-2026-42212: anzory SolidCAM-GPPL-IDE XXE and XML bomb in VMID parser

CVE-2026-42212 · Severity: info · CVSS 7.1 · Published 2026-05-08

Executive brief

SolidCAM-GPPL-IDE is a development tool used to edit and manage postprocessor files for SolidCAM software. A security flaw allows a malicious file to crash the tool or potentially steal sensitive local files if a user opens a specially crafted project. This could lead to a loss of productivity or the exposure of private configuration data when opening files shared via forums or email.

Technical details

The SolidCAM-GPPL-IDE extension's language server fails to properly restrict DTD processing when parsing .vmid files. Specifically, the VMID parser utilizes XDocument.Load(path) without explicit XmlReaderSettings, inheriting .NET 8 defaults that allow DTD processing. An attacker can exploit this by providing a malicious .vmid file alongside a .gpp file; when the user opens the .gpp file, the parser may disclose local files via external entity references or trigger a 'billion-laughs' denial-of-service attack through recursive entity expansion. The vulnerability is addressed in version 1.0.2 by prohibiting DTD processing and implementing size/depth caps on XML parsing.

Affected products

  • anzory SolidCAM-GPPL-IDE (VS Code Extension) 1.0.0 to 1.0.1

Timeline

  • 2026-04-20: patched: Fixed in version 1.0.2
  • 2026-05-08: disclosed: CVE-2026-42212 published

References

Related threats