CVE-2022-0217

It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat version used, it may also allow injections using XML External Entity References (CWE-611).

• CWE-776
• CWE-611
• CWE-776

• https://bugzilla.redhat.com/show_bug.cgi?id=2040639Issue Tracking, Third Party Advisory
• https://prosody.im/security/advisory_20220113/Exploit, Patch, Vendor Advisory
• https://prosody.im/security/advisory_20220113/1.patchPatch, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2040639Issue Tracking, Third Party Advisory
• https://prosody.im/security/advisory_20220113/Exploit, Patch, Vendor Advisory
• https://prosody.im/security/advisory_20220113/1.patchPatch, Vendor Advisory

Published

Aug 26, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-0211The Shield Security WordPress plugin before 13.0.6 does not …4.8
• CVE-2022-0212The SpiderCalendar WordPress plugin through 1.5.65 does not …6.1
• CVE-2022-0213vim is vulnerable to Heap-based Buffer Overflow6.6
• CVE-2022-0214The Custom Popup Builder WordPress plugin before 1.3.1 autol…7.5
• CVE-2022-0215The Login/Signup Popup, Waitlist Woocommerce ( Back in stock…8.8
• CVE-2022-0216A use-after-free vulnerability was found in the LSI53C895A S…4.4
• CVE-2022-0218The WP HTML Mail WordPress plugin is vulnerable to unauthori…6.1
• CVE-2022-0219Improper Restriction of XML External Entity Reference in Git…5.5
• CVE-2022-0220The check_privacy_settings AJAX action of the WordPress GDPR…6.1
• CVE-2022-0221A CWE-611: Improper Restriction of XML External Entity Refer…5.5
• CVE-2022-0222A CWE-269: Improper Privilege Management vulnerability exist…7.5
• CVE-2022-0223A CWE-22: Improper Limitation of a Pathname to a Restricted …9.8