Safeguard
Tag

xxe

Safeguard articles tagged "xxe" — guides, analysis, and best practices for software supply chain and application security.

18 articles

Security

XXE Fix in Java: How to Harden Every XML Parser

The XXE fix in Java is the same idea across every parser — turn off DOCTYPE and external entities before you feed it untrusted XML. Here are the exact settings for each JDK XML API.

Feb 25, 20256 min read
AppSec

Choosing an npm XML Parser: Security Comparison and XXE Pitfalls

Not every npm XML parser carries the same risk. We compare xml2js, fast-xml-parser, sax, and libxmljs on their CVE history, XXE exposure, and safe configuration.

Feb 18, 20257 min read
Security

How to Use PyPI openpyxl Safely: Security Risks and Fixes

The openpyxl package on PyPI is safe for most workloads, but XML parsing and spreadsheet formula injection deserve attention. Here is what to watch for.

Feb 13, 20255 min read
Security

XXE Attack Demo: Understanding and Defending Against XML External Entities

An XXE attack demo makes the vulnerability click: an XML parser that trusts external entities can be tricked into reading files or making requests. Here is how it works and how to shut it down.

Jan 29, 20255 min read
AppSec

xercesImpl: XXE Risks in Java XML Parsing and How to Configure It

The xercesImpl Maven artifact turns up transitively in thousands of Java builds. Here is its real CVE history, why XXE is your configuration's fault, and the hardening block to paste.

Jan 16, 20256 min read
Code Security

XML External Entity (XXE) Prevention: Disabling the Features That Attack You

XXE attacks exploit XML parser features that most applications never need. Here is how to disable them across every major language and framework.

Feb 18, 20245 min read

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.

xxe (Page 2) — Safeguard Blog