CVE-2021-47621

ClassGraph XML External Entity Reference

7.5 HighFix available

ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.56%Up 0.5 points since Jun 21, 2024

What each source reports

CVE List Score used 7.5

ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.

Record: CVE-2021-47621
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-611
Updated: 2026-11-02

EUVDEUVD-2024-2166 7.5

ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.

Record: EUVD-2024-2166
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-v2xm-76pq-phcf 6.9

ClassGraph XML External Entity Reference

ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.

Record: GHSA-v2xm-76pq-phcf
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-611
Updated: 2026-11-02

NVD 7.5

ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.

Record: CVE-2021-47621
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-611
Updated: 2026-11-02

OSV 7.5

ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.

Record: CVE-2021-47621
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVGHSA-v2xm-76pq-phcf 6.9

ClassGraph XML External Entity Reference

ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.

Record: GHSA-v2xm-76pq-phcf
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-611
Updated: 2026-11-02

OSVRHLW-2026-27d595c7dc400686 7.5

Lightwell Security Advisory: classgraph 4.8.83.rhlw-00001

Red Hat Lightwell has released io.github.classgraph:classgraph 4.8.83.rhlw-00001 with a backported security fix.

CVE-2021-47621: ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.

This patched artifact is a drop-in replacement for io.github.classgraph:classgraph 4.8.83 from Maven Central.

Record: RHLW-2026-27d595c7dc400686
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHLW-2026-9bd677f780e42d38 7.5

Lightwell Security Advisory: classgraph 4.8.36.rhlw-00001

Red Hat Lightwell has released io.github.classgraph:classgraph 4.8.36.rhlw-00001 with a backported security fix.

CVE-2021-47621: ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.

This patched artifact is a drop-in replacement for io.github.classgraph:classgraph 4.8.36 from Maven Central.

Record: RHLW-2026-9bd677f780e42d38
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVROOT-APP-MAVEN-CVE-2021-47621 No score

CVE-2021-47621 in io.root.io.github.classgraph:classgraph - Patched by Root

Root has patched CVE-2021-47621 in the io.root.io.github.classgraph:classgraph package for Root:Maven. Multiple fixed versions available.

Record: ROOT-APP-MAVEN-CVE-2021-47621
Updated: 2026-11-02

Affected products

classgraph

Affected packages

Affected packages
Package	Affected	Fixed
`io.github.classgraph:classgraph` Maven	before 4.8.112	4.8.112
`io.github.classgraph:classgraph` Maven	before 4.8.112, plus listed versions 4.0.04.0.0-beta-114.0.0-beta-124.0.14.0.2 Show 45 moreShow less 4.0.34.0.44.0.54.0.64.0.74.1.04.1.14.1.24.1.34.1.44.1.54.1.64.1.74.2.04.2.14.2.104.2.114.2.124.2.24.2.34.2.44.2.54.2.64.2.74.2.84.2.94.3.04.3.14.4.04.4.14.4.104.4.114.4.124.4.24.4.34.4.44.4.54.4.64.4.74.4.84.4.94.6.04.6.14.6.104.6.11	4.8.112
`io.github.classgraph:classgraph` Red Hat Lightwell:Maven	4.8.83 up to 4.8.83.rhlw-00001	4.8.83.rhlw-00001
`io.github.classgraph:classgraph` Red Hat Lightwell:Maven	before 4.8.36.rhlw-00001, plus listed versions 4.0.04.0.0-beta-114.0.0-beta-124.0.14.0.2 Show 45 moreShow less 4.0.34.0.44.0.54.0.64.0.74.1.04.1.14.1.24.1.34.1.44.1.54.1.64.1.74.2.04.2.14.2.104.2.114.2.124.2.24.2.34.2.44.2.54.2.64.2.74.2.84.2.94.3.04.3.14.4.04.4.14.4.104.4.114.4.124.4.24.4.34.4.44.4.54.4.64.4.74.4.84.4.94.6.04.6.14.6.104.6.11	4.8.36.rhlw-00001
`io.root.io.github.classgraph:classgraph` Root:Maven	before 4.8.21-root.io.1	4.8.21-root.io.1
`io.github.classgraph:classgraph` Root:Maven	before 4.8.21-aikido.1	4.8.21-aikido.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-47621 is a high vulnerability (CVSS 7.5) in Classgraph, published June 21, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.56%, the 46th percentile. Fixed in io.github.classgraph:classgraph 4.8.112.

References

This page doesn't list everything

Left out here: 204 versions. The JSON record has them.