CVE-2023-25896
published 2023-03-28CVE-2023-25896: Adobe Dimension versions 3.4.7 (and earlier) is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the…
PriorityP339high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
EPSS
0.39%
30.8th percentile
Adobe Dimension versions 3.4.7 (and earlier) is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | dimension | <= 3.4.7 | — |
| adobe | dimension | unspecified – 3.4.7 | — |
| naturalintelligence | fast-xml-parser | >= 4.1.3 < 4.5.4 | 4.5.4 |
| naturalintelligence | fast-xml-parser | >= 5.0.0 < 5.3.5 | 5.3.5 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
ghsa7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
ghsa·2026-02-20·CVSS 7.5
CVE-2026-25896 [HIGH] CWE-185 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
# Entity encoding bypass via regex injection in DOCTYPE entity names
## Summary
A dot (`.`) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (` `, `&`, `"`, `'`) with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered.
## Details
The fix for CVE-2023-34104 addressed some regex metacharacters in entity names but missed `.` (period), which is valid in XML names per the W3C spec.
In `DocTypeReader.js`, entity names are passed directly to `RegExp()`:
```js
entities[entityName] = {
regx: RegExp(`&${entityName};`, "g"),
val: val
};
```
An entity named `l.` produces the
GHSA
GHSA-rx7p-v2jr-jjc3: Adobe Dimension versions 3
ghsa_unreviewed·2023-03-28
CVE-2023-25896 [HIGH] CWE-416 GHSA-rx7p-v2jr-jjc3: Adobe Dimension versions 3
Adobe Dimension versions 3.4.7 (and earlier) is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-03-28
Published