CVE-2017-18197

CVE-2017-18197 is a critical XML External Entity (XXE) vulnerability affecting jgraph mxGraph versions prior to 3.7.6, specifically within the mxGraphViewImageReader.java component. This flaw allows an unauthenticated attacker to exploit missing security flags in the SAXParserFactory instance during the convert() function. With a CVSS score of 9.8 (CRITICAL), successful exploitation can lead to complete compromise of confidentiality, integrity, and availability of the affected system. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion with 10 mentions, indicating awareness and potential for future exploitation.