skills.rest
latestaiagents
latestaiagentsOFFICIAL
Explore all skills by this author →
GitHub

xxe-prevention

Configure XML parsers to disable DTDs and external entities across languages.

5|1|Updated Feb 4, 2026
Search Tags:#security#vulnerability#owasp#secure coding#xxe#xml parsing
One-click install
npx skills add https://github.com/latestaiagents/agent-skills --skill xxe-prevention
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: xxe-prevention
Source: https://github.com/latestaiagents/agent-skills/tree/main/skills/security/owasp-guardian/xxe-prevention
Command: npx skills add https://github.com/latestaiagents/agent-skills --skill xxe-prevention

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill prevents XML External Entity (XXE) attacks, a critical vulnerability that can lead to data breaches, server-side request forgery, and denial-of-service conditions when processing XML input.

Core Features & Use Cases

  • Secure XML Parsing: Configures XML parsers to disable dangerous features like DTDs and external entities.
  • Vulnerability Mitigation: Protects against attacks exploiting XML parsers in various languages (Node.js, Python, Java, PHP, .NET).
  • SVG and Office Document Security: Provides guidance on sanitizing SVG uploads and validating Office documents (DOCX, XLSX) which contain XML.
  • Use Case: When your application accepts user-uploaded XML files or processes data from external XML sources, use this skill to ensure the parser is configured securely, preventing attackers from reading local files or accessing internal network resources.

Quick Start

Use the xxe-prevention skill to secure your XML parsing logic in Node.js by disabling external entities.

Frequently Asked Questions about xxe-prevention

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent XXE attacks when parsing user-supplied XML in Java or Python?▼

To prevent XXE attacks, configure your XML parser to disable DTDs and external entities. This stops attackers from reading local files, accessing internal network resources, or causing denial-of-service.

What is an XML External Entity vulnerability and when does it occur?▼

An XML External Entity (XXE) vulnerability occurs when an XML parser processes malicious DTDs, allowing attackers to read local files or perform SSRF. It happens when processing user-supplied XML, SOAP requests, or document uploads.

How do I securely parse SVG uploads and Office documents to block XXE?▼

Securely parse SVG uploads and Office documents (DOCX, XLSX) by configuring the XML parser to disable network access and external entities. This sanitizes embedded XML structures against hidden malicious payloads.

Does this XXE prevention approach work across Node.js, .NET, and PHP?▼

Yes, this approach works across Node.js, Python, Java, PHP, and .NET. It applies secure coding practices and library configurations specific to each language to disable dangerous XML parsing features.

What is the best way to secure SOAP request processing against XML attacks?▼

The best way to secure SOAP request processing is to disable DTDs and external entities in the underlying XML parser configuration. This prevents malicious payloads from exploiting the XML structure to access internal resources.

Related Skills

Explore More Software Engineering Skills→
ersinkocersinkoc
56

sc-xxe

Detect XML External Entity vulnerabilities across Java, C#, Python, PHP, Go, and Node.js parsers.

Community
Advanced
ArianHobson333ArianHobson333
7

xxe

Detect XML External Entity flaws in Java, Python, and .NET XML parsers.

Community
Advanced
brucesongsbrucesongs
60

web-xxe

Identify and exploit XML External Entity vulnerabilities in XML-processing endpoints.

Community
Advanced
DevelopersCoffeeDevelopersCoffee
3

cwe-776-xml-entity-expansion

Remediate CWE-776 XML Entity Expansion vulnerabilities in Java XML parsing code.

Official
Intermediate