CVE-2024-31573
XMLUnit for Java has Insecure Defaults when Processing XSLT Stylesheets
XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.
- Record
CVE-2024-31573- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-669
- Updated
- 2026-11-02
EUVDEUVD-2024-1578
XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.
- Record
EUVD-2024-1578- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-chfm-68vv-pvw5 No score
XMLUnit for Java has Insecure Defaults when Processing XSLT Stylesheets
Impact
When performing XSLT transformations XMLUnit for Java did not disable XSLT extension functions by default. Depending on the XSLT processor being used this could allow arbitrary code to be executed when XMLUnit is used to transform data with a stylesheet who's source can not be trusted. If the stylesheet can be provided externally this may even lead to a remote code execution.
Patches
Users are advised to upgrade to XMLUnit for Java 2.10.0 where the default has been changed by means of https://github.com/xmlunit/xmlunit/commit/b81d48b71dfd2868bdfc30a3e17ff973f32bc15b
Workarounds
XMLUnit's main use-case is performing tests on code that generates or processes XML. Most users will not use it to perform arbitrary XSLT transformations.
Users running XSLT transformations with untrusted stylesheets should explicitly use XMLUnit's APIs to pass in a pre-configured TraX TransformerFactory with extension functions disabled via features and attributes. The required setFactory or setTransformerFactory methods have been available since XMLUnit for Java 2.0.0.
References
- Record
GHSA-chfm-68vv-pvw5- Updated
- 2026-11-02
NVD
XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.
- Record
CVE-2024-31573- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-669
- Updated
- 2026-11-02
OSV
XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.
- Record
CVE-2024-31573- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-669
- Updated
- 2026-11-11
OSVOESA-2025-1966
xmlunit security update
Security Fix(es):
A vulnerability was found in xmlunit-core. It has been declared as problematic.As an impact it is known to affect confidentiality, integrity, and availability.Upgrading to version 2.10.0 eliminates this vulnerability.(CVE-2024-31573)
- Record
OESA-2025-1966- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 15 moreShow less
OSVOESA-2025-1967
xmlunit security update
Security Fix(es):
A vulnerability was found in xmlunit-core. It has been declared as problematic.As an impact it is known to affect confidentiality, integrity, and availability.Upgrading to version 2.10.0 eliminates this vulnerability.(CVE-2024-31573)
- Record
OESA-2025-1967- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVOESA-2025-1968
xmlunit security update
Security Fix(es):
A vulnerability was found in xmlunit-core. It has been declared as problematic.As an impact it is known to affect confidentiality, integrity, and availability.Upgrading to version 2.10.0 eliminates this vulnerability.(CVE-2024-31573)
- Record
OESA-2025-1968- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVOESA-2025-1969
xmlunit security update
Security Fix(es):
A vulnerability was found in xmlunit-core. It has been declared as problematic.As an impact it is known to affect confidentiality, integrity, and availability.Upgrading to version 2.10.0 eliminates this vulnerability.(CVE-2024-31573)
- Record
OESA-2025-1969- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVOESA-2025-1970
xmlunit security update
Security Fix(es):
A vulnerability was found in xmlunit-core. It has been declared as problematic.As an impact it is known to affect confidentiality, integrity, and availability.Upgrading to version 2.10.0 eliminates this vulnerability.(CVE-2024-31573)
- Record
OESA-2025-1970- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVRHLW-2026-bf51d193d76de6ef
Lightwell Security Advisory: xmlunit-assertj3 2.9.1.rhlw-00002
Red Hat Lightwell has released org.xmlunit:xmlunit-assertj3 2.9.1.rhlw-00002 with a backported security fix.
CVE-2024-31573: XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.
This patched artifact is a drop-in replacement for org.xmlunit:xmlunit-assertj3 2.9.1 from Maven Central.
- Record
RHLW-2026-bf51d193d76de6ef- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVRHLW-2026-de2bb03e40c2ec86
Lightwell Security Advisory: xmlunit-assertj3 2.8.4.rhlw-00001
Red Hat Lightwell has released org.xmlunit:xmlunit-assertj3 2.8.4.rhlw-00001 with a backported security fix.
CVE-2024-31573: XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.
This patched artifact is a drop-in replacement for org.xmlunit:xmlunit-assertj3 2.8.4 from Maven Central.
- Record
RHLW-2026-de2bb03e40c2ec86- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVRHLW-2026-e5adae5b227184e1
Lightwell Security Advisory: xmlunit-core 2.9.1.rhlw-00002
Red Hat Lightwell has released org.xmlunit:xmlunit-core 2.9.1.rhlw-00002 with a backported security fix.
CVE-2024-31573: XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.
This patched artifact is a drop-in replacement for org.xmlunit:xmlunit-core 2.9.1 from Maven Central.
- Record
RHLW-2026-e5adae5b227184e1- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVRHLW-2026-ea9f6fe6976a39aa
Lightwell Security Advisory: xmlunit-core 2.8.4.rhlw-00001
Red Hat Lightwell has released org.xmlunit:xmlunit-core 2.8.4.rhlw-00001 with a backported security fix.
CVE-2024-31573: XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.
This patched artifact is a drop-in replacement for org.xmlunit:xmlunit-core 2.8.4 from Maven Central.
- Record
RHLW-2026-ea9f6fe6976a39aa- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-31573
XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.
- Record
UBUNTU-CVE-2024-31573- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2024-1727136010 No score
TuxCare security update for org.xmlunit:xmlunit-core (1 CVE)
TuxCare rebuilt org.xmlunit:xmlunit-core to address 1 CVE. Fixed in 2.9.0.tuxcare.
- Record
CLSA-2024-1727136010- Updated
- 2026-11-02
OSVCLSA-2025-1740614445 No score
TuxCare security update for org.xmlunit:xmlunit-core (1 CVE)
TuxCare rebuilt org.xmlunit:xmlunit-core to address 1 CVE. Fixed in 2.9.1.tuxcare.
- Record
CLSA-2025-1740614445- Updated
- 2026-11-02
OSVCLSA-2026-1793128026 No score
TuxCare security update for org.xmlunit:xmlunit-core (1 CVE)
TuxCare rebuilt org.xmlunit:xmlunit-core to address 1 CVE. Fixed in 2.6.3-tuxcare.1.
- Record
CLSA-2026-1793128026- Updated
- 2026-11-02
OSVCLSA-2026-1793834532 No score
TuxCare security update for org.xmlunit:xmlunit-core (1 CVE)
TuxCare rebuilt org.xmlunit:xmlunit-core to address 1 CVE. Fixed in 2.7.0-tuxcare.2.
- Record
CLSA-2026-1793834532- Updated
- 2026-11-05
OSVGHSA-chfm-68vv-pvw5 No score
XMLUnit for Java has Insecure Defaults when Processing XSLT Stylesheets
Impact
When performing XSLT transformations XMLUnit for Java did not disable XSLT extension functions by default. Depending on the XSLT processor being used this could allow arbitrary code to be executed when XMLUnit is used to transform data with a stylesheet who's source can not be trusted. If the stylesheet can be provided externally this may even lead to a remote code execution.
Patches
Users are advised to upgrade to XMLUnit for Java 2.10.0 where the default has been changed by means of https://github.com/xmlunit/xmlunit/commit/b81d48b71dfd2868bdfc30a3e17ff973f32bc15b
Workarounds
XMLUnit's main use-case is performing tests on code that generates or processes XML. Most users will not use it to perform arbitrary XSLT transformations.
Users running XSLT transformations with untrusted stylesheets should explicitly use XMLUnit's APIs to pass in a pre-configured TraX TransformerFactory with extension functions disabled via features and attributes. The required setFactory or setTransformerFactory methods have been available since XMLUnit for Java 2.0.0.
References
- Record
GHSA-chfm-68vv-pvw5- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2024-31573 No score
CVE-2024-31573 in io.root.org.xmlunit:xmlunit-core - Patched by Root
Root has patched CVE-2024-31573 in the io.root.org.xmlunit:xmlunit-core package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2024-31573- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.xmlunit:xmlunit-coreMaven |
before 2.10.0 | 2.10.0 |
org.xmlunit:xmlunit-coreTuxCare:Maven |
2.9.0 up to 2.9.0.tuxcare | 2.9.0.tuxcare |
org.xmlunit:xmlunit-coreTuxCare:Maven |
2.9.1 up to 2.9.1.tuxcare | 2.9.1.tuxcare |
org.xmlunit:xmlunit-coreTuxCare:Maven |
2.6.3 up to 2.6.3-tuxcare.1 | 2.6.3-tuxcare.1 |
org.xmlunit:xmlunit-coreTuxCare:Maven |
2.7.0 up to 2.7.0-tuxcare.2, plus listed versions 2.7.0-tuxcare.1 |
2.7.0-tuxcare.2 |
org.xmlunit:xmlunit-coreMaven |
before 2.10.0, plus listed versions 2.0.02.0.0-alpha-022.0.0-alpha-032.0.0-alpha-042.1.0 Show 20 moreShow less2.1.12.2.02.2.12.3.02.4.02.5.02.5.12.6.02.6.12.6.22.6.32.6.42.7.02.8.02.8.12.8.22.8.32.8.42.9.02.9.1 |
2.10.0 |
xmlunitopenEuler:22.03-LTS-SP4 |
before 2.7.0-2.oe2203sp4 | 2.7.0-2.oe2203sp4 |
xmlunitopenEuler:24.03-LTS |
before 2.7.0-3.oe2403 | 2.7.0-3.oe2403 |
xmlunitopenEuler:24.03-LTS-SP1 |
before 2.7.0-3.oe2403sp1 | 2.7.0-3.oe2403sp1 |
xmlunitopenEuler:24.03-LTS-SP2 |
before 2.7.0-3.oe2403sp2 | 2.7.0-3.oe2403sp2 |
Show 15 moreShow less
| Package | Affected | Fixed |
|---|---|---|
xmlunitopenEuler:22.03-LTS-SP3 |
before 2.7.0-2.oe2203sp3 | 2.7.0-2.oe2203sp3 |
org.xmlunit:xmlunit-assertj3Red Hat Lightwell:Maven |
2.9.1 up to 2.9.1.rhlw-00002 | 2.9.1.rhlw-00002 |
org.xmlunit:xmlunit-assertj3Red Hat Lightwell:Maven |
before 2.8.4.rhlw-00001, plus listed versions 2.8.12.8.22.8.32.8.4 |
2.8.4.rhlw-00001 |
org.xmlunit:xmlunit-coreRed Hat Lightwell:Maven |
2.9.1 up to 2.9.1.rhlw-00002 | 2.9.1.rhlw-00002 |
org.xmlunit:xmlunit-coreRed Hat Lightwell:Maven |
before 2.8.4.rhlw-00001, plus listed versions 2.0.02.0.0-alpha-022.0.0-alpha-032.0.0-alpha-042.1.0 Show 18 moreShow less2.1.12.2.02.2.12.3.02.4.02.5.02.5.12.6.02.6.12.6.22.6.32.6.42.7.02.8.02.8.12.8.22.8.32.8.4 |
2.8.4.rhlw-00001 |
io.root.org.xmlunit:xmlunit-coreRoot:Maven |
before 2.9.1-root.io.1 | 2.9.1-root.io.1 |
org.xmlunit:xmlunit-coreRoot:Maven |
before 2.9.1-aikido.1 | 2.9.1-aikido.1 |
xmlunitUbuntu:16.04:LTS |
All versions, plus listed versions 1.6-1 |
None known |
xmlunitUbuntu:18.04:LTS |
All versions, plus listed versions 1.6-1 |
None known |
xmlunitUbuntu:20.04:LTS |
All versions, plus listed versions 1.6-11.6-2 |
None known |
xmlunitUbuntu:22.04:LTS |
All versions, plus listed versions 1.6-2 |
None known |
xmlunitUbuntu:24.04:LTS |
All versions, plus listed versions 1.6-2 |
None known |
xmlunitUbuntu:25.10 |
All versions, plus listed versions 1.6-2 |
None known |
xmlunitUbuntu:26.10 |
All versions, plus listed versions 1.6-2build1 |
None known |
xmlunitUbuntu:26.04:LTS |
All versions, plus listed versions 1.6-21.6-2build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-31573 is a medium vulnerability (CVSS 4.0) in Xmlunit For Java, published May 1, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. Fixed in org.xmlunit:xmlunit-core 2.10.0.
References
github.com/advisories/GHSA-chfm-68vv-pvw5
docs.oracle.com/en/java/javase/22/security/java-api-xml-processing-jaxp-security-guide.html
Show 9 moreShow less
nvd.nist.gov/vuln/detail/CVE-2024-31573
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-1966
ubuntu.com/security/CVE-2024-31573
cve.org/CVERecord?id=CVE-2024-31573