CVE-2022-0272
Improper Restriction of XML External Entity Reference in detekt/detekt
Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Improper Restriction of XML External Entity Reference in detekt/detekt
Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0.
- Record
CVE-2022-0272- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-611
- Updated
- 2026-11-02
EUVDEUVD-2022-1596
Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0.
- Record
EUVD-2022-1596- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2cfc-865j-gm4w
XML External Entity Reference in detekt
Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0.
- Record
GHSA-2cfc-865j-gm4w- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-611
- Updated
- 2026-11-02
NVD
Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0.
- Record
CVE-2022-0272- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-611
- Updated
- 2026-11-02
OSV
Improper Restriction of XML External Entity Reference in detekt/detekt
Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0.
- Record
CVE-2022-0272- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-611
- Updated
- 2026-11-02
OSVGHSA-2cfc-865j-gm4w
XML External Entity Reference in detekt
Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0.
- Record
GHSA-2cfc-865j-gm4w- CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-611
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.gitlab.arturbosch.detekt:detekt-coreMaven |
before 1.20.0 | 1.20.0 |
io.gitlab.arturbosch.detekt:detekt-coreMaven |
before 1.20.0, plus listed versions 1.0.01.0.0-RC101.0.0-RC111.0.0-RC131.0.0-RC14 Show 45 moreShow less1.0.0-RC151.0.0-RC161.0.0-gradle-rework-beta11.0.0-gradle-rework-beta21.0.0-gradle-rework-beta31.0.0.RC7-31.0.0.RC81.0.0.RC8-beta1.0.0.RC9.21.0.11.1.01.1.11.10.01.10.0-RC11.11.01.11.0-RC11.11.0-RC21.11.11.11.21.12.01.12.0-RC11.13.11.14.01.14.11.14.21.15.01.15.0-RC11.15.0-RC21.16.01.16.0-RC11.16.0-RC21.16.0-RC31.17.01.17.0-RC11.17.0-RC21.17.0-RC31.17.11.18.01.18.0-RC11.18.0-RC21.18.0-RC31.18.11.19.01.19.0-RC11.19.0-RC2 |
1.20.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-0272 is a high vulnerability (CVSS 7.3) in Detekt, published April 21, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.44%, the 73rd percentile. Fixed in io.gitlab.arturbosch.detekt:detekt-core 1.20.0.
References
huntr.dev/bounties/23e37ba7-96d5-4037-a90a-8c8f4a70ce44
github.com/detekt/detekt/commit/c965a8d2a6bbdb9bcfc6acfa7bbffd3da81f5395
nvd.nist.gov/vuln/detail/CVE-2022-0272
Left out here: 20 versions. The JSON record has them.