Acknowledgement

• The maintainer(s) of the affected project have already been made aware of this vulnerability.

Description

logicalQuery.Select() in github.com/antchfx/xpath enters an infinite
loop when a boolean XPath expression that evaluates to true is used as
a top-level node selector (e.g. 0<1, 1=1, true()).

The function returns t.Current().Copy() on every call when the
expression is true, and never returns nil. The iteration loop in
callers such as QuerySelectorAll calls MoveNext() in a for loop
that only terminates when Select() returns nil. Since that condition
is never met, the goroutine is permanently stalled and one CPU core is
consumed at 100% until the process is killed.

All other query types in the same file (contextQuery, absoluteQuery)
correctly track a done or count field and return nil after the
first result. logicalQuery is missing this termination guard entirely.

Any application that passes user-controlled input as an XPath expression
to Find(), QueryAll(), or QuerySelectorAll() in the downstream
packages antchfx/xmlquery, antchfx/htmlquery, or
antchfx/jsonquery is vulnerable to an unbounded CPU
denial-of-service.

Affected Modules, Packages, Versions and Symbols

Module: github.com/antchfx/xpath
  Package: github.com/antchfx/xpath
  Versions:
    - Introduced: 1.0.0
    - Fixed: not yet fixed
  Symbols:
    - logicalQuery.Select

CVE/GHSA ID

No response

Fix Commit or Pull Request

No response

References

• Infinite loop in logicalQuery.Select() when boolean XPath expression evaluates to true antchfx/xpath#121
• https://securityinfinity.com/research/infinite-loop-dos-in-antchfx-xpath-logicalquery-select/

Additional information

Trigger expressions (all cause infinite loop):
0<1, 1=1, 1>0, 0<=1, 1!=2, true(), not(false())

Expressions evaluating to false return normally — only true expressions
are affected.

The downstream packages antchfx/xmlquery (v1.5.0), antchfx/htmlquery
(v1.3.5), and antchfx/jsonquery (v1.3.6) all inherit this vulnerability
through their dependency on antchfx/xpath.

CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H — 7.5 High
CWE-835: Loop with Unreachable Exit Condition