CVE-2019-9843
Improper Restriction of XML External Entity Reference in DiffPlug Spotless
In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a victim performs a spotlessApply operation on an untrusted XML file.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a victim performs a spotlessApply operation on an untrusted XML file.
- Record
CVE-2019-9843- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 5.1 Medium
AV:N/AC:H/Au:N/C:P/I:P/A:P - Weakness
- CWE-611
- Updated
- 2026-11-02
CVE List No score
In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a victim performs a spotlessApply operation on an untrusted XML file.
- Record
CVE-2019-9843- Updated
- 2026-11-02
EUVDEUVD-2019-0583 No score
In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a victim performs a spotlessApply operation on an untrusted XML file.
- Record
EUVD-2019-0583- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7v35-qwwj-p98g
Improper Restriction of XML External Entity Reference in DiffPlug Spotless
In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a victim performs a spotlessApply operation on an untrusted XML file.
- Record
GHSA-7v35-qwwj-p98g- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
OSV
In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a victim performs a spotlessApply operation on an untrusted XML file.
- Record
CVE-2019-9843- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-7v35-qwwj-p98g
Improper Restriction of XML External Entity Reference in DiffPlug Spotless
In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a victim performs a spotlessApply operation on an untrusted XML file.
- Record
GHSA-7v35-qwwj-p98g- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.diffplug.spotless:spotless-plugin-gradleMaven |
before 3.20.0 | 3.20.0 |
com.diffplug.spotless:spotless-maven-pluginMaven |
before 1.20.0 | 1.20.0 |
com.diffplug.spotless:spotless-plugin-gradleMaven |
before 3.20.0, plus listed versions 3.0.03.0.0.BETA23.0.0.BETA33.0.0.RC13.0.0.RC2 Show 23 moreShow less3.1.03.10.03.12.03.13.03.14.03.15.03.16.03.17.03.18.03.19.03.2.03.3.03.3.13.3.23.4.03.4.13.5.03.5.13.5.23.6.03.7.03.8.03.9.0 |
3.20.0 |
com.diffplug.spotless:spotless-maven-pluginMaven |
before 1.20.0, plus listed versions 1.0.0.BETA11.0.0.BETA21.0.0.BETA31.0.0.BETA41.0.0.BETA5 Show 7 moreShow less1.13.01.14.01.15.01.16.01.17.01.18.01.19.0 |
1.20.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-9843 is a high vulnerability (CVSS 7.5) in Diffplug Gradle, published March 15, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.50%, the 74th percentile. Fixed in com.diffplug.spotless:spotless-plugin-gradle 3.20.0.
References
github.com/diffplug/spotless/blob/master/plugin-maven/CHANGES.md
lists.apache.org/thread.html/r7406e297228c42deeecdd12a576e39d63073faebf14b027b7608fdfd%40%3Cissues.iceberg.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2019-9843