CVE-2022-4741 json
docconv XMLToText memory allocation
published 2022-12-25 3 y ago modified 2026-06-17 4 mo ago also GHSA-qvx2-59g8-8hph , GO-2022-1188 , EUVD-2022-7726
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 57%
- public exploits
- 0
- none known
Summary
A vulnerability was found in docconv up to 1.2.0 and classified as problematic. This issue affects the function ConvertDocx/ConvertODT/ConvertPages/ConvertXML/XMLToText. The manipulation leads to uncontrolled memory allocation. The attack may be initiated remotely. Upgrading to version 1.2.1 is able to address this issue. The name of the patch is 42bcff666855ab978e67a9041d0cdea552f20301. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216779.
Patch / fix
- go github.com/sajari/docconv 1.2.1
- go code.sajari.com/docconv 1.2.1
- search docconv 1.2.1
- github.com/sajari/docconv@42bcff6 commit
- github.com/sajari/docconv#111 pull request
- github.com/sajari/docconv/releases/tag/v1.2.1 release
Exploit prediction
0.83% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L |
| CNA | 3.0 | 4.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/sajari/docconv | <1.2.1 |
1.2.1 |
| go | code.sajari.com/docconv | <1.2.1 |
1.2.1 |
Affected products
- n/a docconv
Classification
- Weakness
-
- CWE-789 Memory Allocation with Excessive Size Value
References
-
github.com
/sajari/docconv/pull/111
issue-tracking, web, patch, third-party-advisory
-
github.com
/sajari/docconv/commit/42bcff666855ab978e67a9041d0cdea552f20301
patch, web, third-party-advisory
-
github.com
/sajari/docconv/releases/tag/v1.2.1
patch, web, release-notes, third-party-advisory
-
vuldb.com
/?id.216779
vdb-entry, technical-description, web, third-party-advisory
-
vuldb.com
/?ctiid.216779
signature, permissions-required, web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-4741
advisory
-
github.com
/sajari/docconv
package
-
pkg.go.dev
/vuln/GO-2022-1188
web
Sources
- CVE List CVE-2022-4741
- GitHub Advisory GHSA-qvx2-59g8-8hph
- NVD CVE-2022-4741
- OSV GO-2022-1188
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.