Executive brief
SolidCAM-GPPL-IDE is a development tool used to edit and manage postprocessor files for SolidCAM software. A security flaw allows a malicious file to crash the tool or potentially steal sensitive local files if a user opens a specially crafted project. This could lead to a loss of productivity or the exposure of private configuration data when opening files shared via forums or email.
Technical details
The SolidCAM-GPPL-IDE extension's language server fails to properly restrict DTD processing when parsing .vmid files. Specifically, the VMID parser utilizes XDocument.Load(path) without explicit XmlReaderSettings, inheriting .NET 8 defaults that allow DTD processing. An attacker can exploit this by providing a malicious .vmid file alongside a .gpp file; when the user opens the .gpp file, the parser may disclose local files via external entity references or trigger a 'billion-laughs' denial-of-service attack through recursive entity expansion. The vulnerability is addressed in version 1.0.2 by prohibiting DTD processing and implementing size/depth caps on XML parsing.
Affected products
- anzory SolidCAM-GPPL-IDE (VS Code Extension) 1.0.0 to 1.0.1
Timeline
- 2026-04-20: patched: Fixed in version 1.0.2
- 2026-05-08: disclosed: CVE-2026-42212 published
References
- https://github.com/anzory/SolidCAM-GPPL-IDE/blob/master/CHANGELOG.md
- https://github.com/anzory/SolidCAM-GPPL-IDE/commit/9d0ba808afd143ede448026a5dc681bfdc5c138d
- https://github.com/anzory/SolidCAM-GPPL-IDE/releases/tag/v1.0.2
- https://github.com/anzory/SolidCAM-GPPL-IDE/security/advisories/GHSA-92vg-f4fq-fxm9