TRB-118v1.0.0 · xml_parameter_entity_use_detected
XML parameter entity use detected
XML parameter entity use detected identifies recursive or parameter entity processing requires explicit resource and grammar limits.
CWE mapping
CWE-776insufficient recognition
Assurance
The analyzer verified the reported construct is present in the supplied input.
Conditional: Impact depends on how the destination parser, runtime, or deployment is configured.
Inert example
Displayed as text only. tryb does not execute this example.
<!DOCTYPE x [<!ENTITY demo "example">]><x>&demo;</x>Remediation
remove-capability. Remove the parser or runtime capability that gives this construct power.
Verify: Test with the deployed consumer and confirm the capability is unavailable.
What to verify next
Confirm the exact production parser and security settings before treating this as exploitable.