GHSA-4g2h-vm7x-747c

Suggest an improvement
Source
https://github.com/advisories/GHSA-4g2h-vm7x-747c
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-4g2h-vm7x-747c/GHSA-4g2h-vm7x-747c.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-4g2h-vm7x-747c
Aliases
Published
2026-03-23T12:30:29Z
Modified
2026-03-25T20:11:05.086687Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
esaml XXE vulnerability allows local file disclosure and SSRF via crafted SAML messages
Details

XML External Entity (XXE) vulnerability in esaml (and its forks) allows an attacker to cause the system to read local files and incorporate their contents into processed SAML documents, and potentially perform SSRF via crafted SAML messages.

esaml parses attacker-controlled SAML messages using xmerl_scan:string/2 before signature verification without disabling XML entity expansion. On Erlang/OTP versions before 27, Xmerl allows entities by default, enabling pre-signature XXE attacks. An attacker can cause the host to read local files (e.g., Kubernetes-mounted secrets) into the SAML document. If the attacker is not a trusted SAML SP, signature verification will fail and the document is discarded, but file contents may still be exposed through logs or error messages.

This issue affects all versions of esaml, including forks by arekinath, handnot2, and dropbox. Users running on Erlang/OTP 27 or later are not affected due to Xmerl defaulting to entities disabled.

Database specific 
{
    "github_reviewed_at": "2026-03-25T19:50:48Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-611"
    ],
    "nvd_published_at": "2026-03-23T11:16:24Z"
}
References

Affected packages

Hex / esaml

Package

Name
esaml
Purl
pkg:hex/esaml

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
4.6.0

Affected versions

3.*
3.0.1
3.1.0
3.2.0
3.3.0
3.4.0
3.5.0
3.6.0
3.6.1
3.7.0
4.*
4.0.0
4.1.0
4.2.0
4.3.0
4.4.0
4.5.0
4.6.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-4g2h-vm7x-747c/GHSA-4g2h-vm7x-747c.json"