XXE (XML External Entity) Explained

What Is XXE?

XML External Entity (XXE) is a vulnerability in applications that parse XML input. XML allows defining "entities" that can reference external resources. If a parser processes these references, attackers can:

• Read local files: Access /etc/passwd, configuration files, source code
• Server-Side Request Forgery: Make requests to internal systems
• Denial of Service: Crash the parser with recursive entities
• Port scanning: Discover internal network services

How XXE Works

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<userInfo>
  <name>&xxe;</name>
</userInfo>

<!-- When parsed, &xxe; is replaced with contents of /etc/passwd -->

If a vulnerable server parses this XML, it reads /etc/passwd and includes its contents in the response or processes it as the user's "name".

Is My Vibe-Coded App at Risk?

You might be at risk if your app:

• Accepts XML uploads (documents, configuration files)
• Integrates with SOAP APIs
• Parses SVG images server-side
• Processes Office documents (DOCX, XLSX are XML-based)
• Uses XML-based configuration

How to Prevent XXE

1. Use JSON Instead of XML

The simplest fix is to not use XML at all. JSON parsers don't have external entity features.

2. Disable External Entities

// Using libxmljs2 with safe defaults
const libxmljs = require('libxmljs2');

const doc = libxmljs.parseXml(xmlString, {
  noent: false,     // Disable entity substitution
  dtdload: false,   // Don't load external DTDs
  dtdvalid: false   // Don't validate against DTD
});

// Or use a library designed to be safe
const { XMLParser } = require('fast-xml-parser');
const parser = new XMLParser({
  // fast-xml-parser is XXE-safe by default
});

3. Validate and Sanitize XML

If you must accept XML, validate it against a strict schema and reject anything with DOCTYPE declarations.