ekalinin/sitemap.js 9.0.1

9.0.1 — Security Patch

on GitHub

Security Fixes

• BB-01: Fix XML injection via unescaped xslUrl in stylesheet processing instruction
• BB-02: Enforce 50,000 URL hard limit in XMLToSitemapItemStream parser
• BB-03: Cap parser error array at 100 entries to prevent memory DoS
• BB-04: Reject absolute destinationDir paths in simpleSitemapAndIndex to prevent arbitrary file writes
• BB-05: parseSitemapIndex now destroys source and parser streams immediately when maxEntries limit is exceeded
• Many thanks to @maru1009 For the report