PT-2025-13522 · W3Css · W3Css Validator

Ajohnston9 · Published 2025-03-28 · Updated 2025-08-01 · CVE-2025-1781

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L

Name of the Vulnerable Software and Affected Versions W3CSS Validator versions before cssval-20250226

Description The issue is related to an XXE (XML External Entity) attack in the W3CSS Validator, which allows an attacker to use specially-crafted XML objects to coerce server-side request forgery (SSRF). This could be exploited to read arbitrary local files if an attacker has access to exception messages.

Recommendations For versions before cssval-20250226, update to a version that includes the fix for this issue, as using specially-crafted XML objects can lead to server-side request forgery (SSRF) and exposure of local files. As a temporary workaround, consider restricting access to the XML parsing functionality in the W3CSS Validator until a patch is available.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2025-1781

GHSA-745M-XMQ6-G6X7

Affected Products

W3Css Validator

References · 7

• https://github.com/google/security-research/security/advisories/GHSA-745m-xmq6-g6x7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-1781 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1781 · Security Note
• https://twitter.com/CVEnew/status/1905674334808731972 · Twitter Post
• https://t.me/cveNotify/130585 · Telegram Post
• https://twitter.com/CveFindCom/status/1905621677247009010 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1905663707318763960 · Twitter Post