CVE-2026-29039: Insecure Elementpath Xpath Evaluation
Evaluating XPath expressions using `elementpath` default parsers (XPath2Parser, XPath3Parser, etc.) is unsafe because they support dangerous functions such as `unparsed-text()`, `doc()`, and `environment-variable()`. An attacker can use these functions to read arbitrary files or leak environment variables. Evaluate untrusted XPath using a custom parser with
Pythongreprules fetch cve-2026-29039-insecure-elementpath-xpath-evaluation --engine opengrepDescription
Evaluating XPath expressions using `elementpath` default parsers (XPath2Parser, XPath3Parser, etc.) is unsafe because they support dangerous functions such as `unparsed-text()`, `doc()`, and `environment-variable()`. An attacker can use these functions to read arbitrary files or leak environment variables. Evaluate untrusted XPath using a custom parser with
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.