Security Contact Requested

[prodigysml]

@n33dle and I found a security vulnerability within the mercury project. We were hoping to get a core maintainer's contact details to responsibly disclose this vulnerability.

[ericcwlaw]

thanks for your message. This issue is closed due to lack of specific details.

[n33dle]

Hi @ericcwlaw - we're after some contact details to responsibly disclose a security vulnerability within this mercury project.

[ericcwlaw]

@n33dle @prodigysml Thank you so much for pointing out the Xml External Entity (XXE) security vulnerability and providing your recommendation. We have patched the SimpleXmlParser and finished regression tests. The patch will be added to the release v1.12.28.

[ericcwlaw]

code merged and verified