XXE Attacks Explained: How XML External Entity Exploits Work (with Fixes)

In 2021, a penetration tester disclosed an XXE vulnerability in a healthcare SaaS app: a single crafted XML upload read /etc/passwd and internal AWS metadata from http://169.254.169.254/latest/meta-data/. The fix was two lines of parser config. The bug existed because the library's defaults were unsafe.

This is where most XXE vulnerabilities come from: not careless developers, but library defaults that haven't been hardened.

What Is XXE?

XML External Entity (XXE) is a vulnerability in applications that parse XML input. The XML spec allows "entities" that reference external resources. If the parser follows those references, an attacker controls what gets read.

The four attack classes:

• File read: Pull /etc/passwd, .env, or any readable path
• SSRF: Make server-side HTTP requests to internal IPs, cloud metadata endpoints, or internal APIs
• Denial of service: Recursive entity expansion ("billion laughs") that consumes all memory
• Port scan: Probe internal network services by watching which requests succeed or time out

How the Attack Works

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<userInfo>
  <name>&xxe;</name>
</userInfo>

When a vulnerable parser processes this, it replaces &xxe; with the contents of /etc/passwd before your application code sees the data. The name field in your parsed document now contains the server's user list.

The SSRF variant swaps file:// for http://:

<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/iam/security-credentials/">
]>
<userInfo><name>&xxe;</name></userInfo>

Which Libraries Ship Vulnerable Defaults

libxmljs2 (Node.js)

This is the library behind most reported GSC queries on this topic.

Never rely on defaults. Pass both flags explicitly:

const libxmljs = require('libxmljs2');

const doc = libxmljs.parseXml(xmlString, {
  noent: false,    // disable entity substitution
  dtdload: false,  // don't load external DTDs
  dtdvalid: false, // don't validate against DTD
});

If you're using libxmljs2 as a transitive dependency (pulled in by another package), check what options that package passes. Many wrappers omit all options, accepting whatever the underlying defaults happen to be.

The safe alternative for most use cases is fast-xml-parser, which is XXE-safe by design:

const { XMLParser } = require('fast-xml-parser');

const parser = new XMLParser({
  // No DTD or external entity support. XXE-safe out of the box.
});
const result = parser.parse(xmlString);

lxml (Python)

Python's lxml is the other common source of XXE bugs. Its etree.fromstring and etree.parse functions resolve external entities by default when the document includes a DOCTYPE.

from lxml import etree

# UNSAFE: resolves external entities
tree = etree.fromstring(xml_bytes)

import defusedxml.lxml as safe_lxml

# defusedxml patches lxml to block DTD loading, external entities, and entity expansion
tree = safe_lxml.fromstring(xml_bytes)

You can also configure lxml's parser directly:

from lxml import etree

parser = etree.XMLParser(
    resolve_entities=False,
    no_network=True,
    load_dtd=False,
)
tree = etree.fromstring(xml_bytes, parser)

Java (DocumentBuilderFactory)

Java's default XML parser is also unsafe. This is OWASP's recommended hardening:

DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
dbf.setXIncludeAware(false);
dbf.setExpandEntityReferences(false);

Is Your App at Risk?

Most apps built with Cursor, Bolt, Lovable, or Replit use JSON APIs and are not vulnerable. XXE only matters if your server parses XML.

You are at risk if your app:

• Accepts XML file uploads (exports, imports, configuration)
• Integrates with SOAP APIs (older enterprise services)
• Parses SVG images server-side (thumbnailing, conversion)
• Processes Office documents (DOCX, XLSX, PPTX are ZIP+XML)
• Uses XML-based configuration files

How to Find XXE in Your App

Three places to check:

1. Grep for XML parser imports:

# Node.js
grep -r "require('libxmljs2')\|require('xml2js')\|require('sax')" .

# Python
grep -r "from lxml\|import xml.etree\|import libxml2" .

2. Look for multipart/form-data endpoints that accept XML or SVG content types.

3. Check any library that processes uploaded documents (DOCX parsers, spreadsheet parsers, diagram tools). Search the library's GitHub for "XXE" or "external entity" in open issues.

The Fastest Fix

If you only parse XML in one place and don't need DTD support (most apps don't), the fastest fix is to reject any document that contains a DOCTYPE declaration entirely:

function safeParseXml(xmlString) {
  if (xmlString.includes('<!DOCTYPE') || xmlString.includes('<!ENTITY')) {
    throw new Error('XML DOCTYPE/ENTITY declarations are not allowed');
  }
  return libxmljs.parseXml(xmlString, { noent: false, dtdload: false });
}

This is a belt-and-suspenders approach: reject suspicious input before the parser even runs.