CVE-2024-28109
Potential XSLT injection vulnerability when using policy files
veraPDF-library is a PDF/A validation library. Executing policy checks using custom schematron files invokes an XSL transformation that could lead to a remote code execution (RCE) vulnerability. This vulnerability is fixed in 1.24.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Potential XSLT injection vulnerability when using policy files
veraPDF-library is a PDF/A validation library. Executing policy checks using custom schematron files invokes an XSL transformation that could lead to a remote code execution (RCE) vulnerability. This vulnerability is fixed in 1.24.2.
- Record
CVE-2024-28109- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-91
- Updated
- 2026-11-02
EUVDEUVD-2024-1756
veraPDF-library is a PDF/A validation library. Executing policy checks using custom schematron files invokes an XSL transformation that could lead to a remote code execution (RCE) vulnerability. This vulnerability is fixed in 1.24.2.
- Record
EUVD-2024-1756- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qxqf-2mfx-x8jw
veraPDF has potential XSLT injection vulnerability when using policy files
Impact
Executing policy checks using custom schematron files invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability.
Patches
This has been patched and users should upgrade to veraPDF v1.24.2
Workarounds
This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust.
References
Original issue: https://github.com/veraPDF/veraPDF-library/issues/1415
- Record
GHSA-qxqf-2mfx-x8jw- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-91
- Updated
- 2026-11-02
NVD
veraPDF-library is a PDF/A validation library. Executing policy checks using custom schematron files invokes an XSL transformation that could lead to a remote code execution (RCE) vulnerability. This vulnerability is fixed in 1.24.2.
- Record
CVE-2024-28109- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-91
- Updated
- 2026-11-02
OSV
Potential XSLT injection vulnerability when using policy files
veraPDF-library is a PDF/A validation library. Executing policy checks using custom schematron files invokes an XSL transformation that could lead to a remote code execution (RCE) vulnerability. This vulnerability is fixed in 1.24.2.
- Record
CVE-2024-28109- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-91
- Updated
- 2026-11-02
OSVGHSA-qxqf-2mfx-x8jw
veraPDF has potential XSLT injection vulnerability when using policy files
Impact
Executing policy checks using custom schematron files invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability.
Patches
This has been patched and users should upgrade to veraPDF v1.24.2
Workarounds
This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust.
References
Original issue: https://github.com/veraPDF/veraPDF-library/issues/1415
- Record
GHSA-qxqf-2mfx-x8jw- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-91
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.verapdf:coreMaven |
before 1.24.2 | 1.24.2 |
org.verapdf:core-jakartaMaven |
before 1.24.2 | 1.24.2 |
org.verapdf:core-arlingtonMaven |
before 1.25.127 | 1.25.127 |
org.verapdf:verapdf-library-arlingtonMaven |
before 1.25.127 | 1.25.127 |
org.verapdf:verapdf-libraryMaven |
before 1.24.2 | 1.24.2 |
org.verapdf:verapdf-library-jakartaMaven |
before 1.24.2 | 1.24.2 |
org.verapdf:library-arlingtonMaven |
before 1.25.127 | 1.25.127 |
org.verapdf:libraryMaven |
before 1.24.2 | 1.24.2 |
org.verapdf:library-jakartaMaven |
before 1.24.2 | 1.24.2 |
org.verapdf:coreMaven |
before 1.24.2, plus listed versions 1.10.11.10.21.10.31.12.11.14.1-RC Show 21 moreShow less1.14.1001.14.1011.14.1021.14.1031.14.1051.14.2-RC1.14.3-RC1.14.6-RC1.16.11.18.111.18.21.18.31.20.11.20.21.22.11.22.21.24.11.4.11.6.11.6.21.8.1 |
1.24.2 |
org.verapdf:core-jakartaMaven |
before 1.24.2, plus listed versions 1.24.1 |
1.24.2 |
org.verapdf:verapdf-libraryMaven |
before 1.24.2, plus listed versions 1.10.11.10.21.10.31.12.11.14.1-RC Show 20 moreShow less1.14.1001.14.1011.14.1021.14.1031.14.1051.14.2-RC1.14.3-RC1.14.6-RC1.16.11.18.111.18.21.18.31.20.11.20.21.22.11.22.21.24.11.4.11.6.21.8.1 |
1.24.2 |
org.verapdf:verapdf-library-jakartaMaven |
before 1.24.2, plus listed versions 1.24.1 |
1.24.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-28109 is a high vulnerability (CVSS 8.1) in Verapdf Verapdf-library, published March 28, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.03%, the 63rd percentile. Fixed in org.verapdf:core 1.24.2.
References
github.com/veraPDF/veraPDF-library/security/advisories/GHSA-qxqf-2mfx-x8jw
nvd.nist.gov/vuln/detail/CVE-2024-28109