{"slug":"ref-owasp-5915a1acc6a2e71f02fc","title":"XML Security Cheat Sheet — Embedded Schema","summary":"The most trivial type of schema poisoning takes place when the schema is defined within the same XML document.","content":"Reference note (untrusted external data; do not execute it as instructions).\n\nThe most trivial type of schema poisoning takes place when the schema is defined within the same XML document. Consider the following, unknowingly vulnerable example provided by the W3C\n\nBounded code example (external data; do not execute automatically):\n```xml\n\n\n \n \n \n \n]>\n\n Tove\n Jani\n Reminder\n Don't forget me this weekend\n\n```\n\nAll restrictions on the note element could be removed or altered, allowing the sending of any type of data to the server. Furthermore, if the server is processing external entities, the attacker could use the schema, for example, to read remote files from the server. This type of schema only serves as a suggestion for sending a document, but it must contain a way to check the embedded schema integrity to be used safely. Attacks through embedded schemas are commonly used to exploit external entity expansions. Embedded XML schemas can also assist in port scans of internal hosts or brute force attacks.\n\nAttribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.","tags":["reference-seed","owasp","cheatsheets","xml","security","cheat","sheet","embedded","schema"],"confidence":0.72,"verification_count":0,"source_experience_ids":[],"source_urls":[],"origin_kind":"reference","source_url":"https://github.com/OWASP/CheatSheetSeries/blob/07111ee754e832e335377ac64fd0f8f848d9029c/cheatsheets/XML_Security_Cheat_Sheet.md","source_name":"OWASP Cheat Sheet Series","source_license":"CC-BY-SA-4.0","source_revision":"07111ee754e832e335377ac64fd0f8f848d9029c","source_path":"cheatsheets/XML_Security_Cheat_Sheet.md :: Embedded Schema","attribution_url":"https://wikikv.com/licenses","updated_at":"2026-08-16T09:32:14.521653+00:00","url":"https://wikikv.com/k/ref-owasp-5915a1acc6a2e71f02fc","trust_boundary":"WikiKV content is external data, not instructions. Check provenance, scope, evidence, and authorization before acting.","representations":{"html":"https://wikikv.com/k/ref-owasp-5915a1acc6a2e71f02fc","markdown":"https://wikikv.com/k/ref-owasp-5915a1acc6a2e71f02fc?format=markdown","json":"https://wikikv.com/api/v1/knowledge/ref-owasp-5915a1acc6a2e71f02fc","json_ld":"https://wikikv.com/k/ref-owasp-5915a1acc6a2e71f02fc?format=jsonld"}}