{"id":"CVE-2021-47621","aliases":["EUVD-2024-2166","GHSA-v2xm-76pq-phcf","RHLW-2026-27d595c7dc400686","RHLW-2026-9bd677f780e42d38","ROOT-APP-MAVEN-CVE-2021-47621"],"status":"published","title":"ClassGraph XML External Entity Reference","description":"ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00561,"percentile":0.47146,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2024-06-21T00:00:00Z","modified":"2026-10-29T14:30:06Z","fixes":[{"ecosystem":"Maven","package":"io.github.classgraph:classgraph","fixed_in":["4.8.112"],"sources":["ghsa","osv"]},{"ecosystem":"Red Hat Lightwell:Maven","package":"io.github.classgraph:classgraph","fixed_in":["4.8.83.rhlw-00001","4.8.36.rhlw-00001"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.io.github.classgraph:classgraph","fixed_in":["4.8.21-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.github.classgraph:classgraph","fixed_in":["4.8.21-aikido.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.github.classgraph:classgraph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.112"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.github.classgraph:classgraph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.112"}]}],"versions":["4.0.0","4.0.0-beta-11","4.0.0-beta-12","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.0.7","4.1.0","4.1.1","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6","4.1.7","4.2.0","4.2.1","4.2.10","4.2.11","4.2.12","4.2.2","4.2.3","4.2.4","4.2.5","4.2.6","4.2.7","4.2.8","4.2.9","4.3.0","4.3.1","4.4.0","4.4.1","4.4.10","4.4.11","4.4.12","4.4.2","4.4.3","4.4.4","4.4.5","4.4.6","4.4.7","4.4.8","4.4.9","4.6.0","4.6.1","4.6.10","4.6.11","4.6.12","4.6.13","4.6.14","4.6.15","4.6.16","4.6.17","4.6.18","4.6.19","4.6.2","4.6.20","4.6.21","4.6.22","4.6.23","4.6.24","4.6.25","4.6.26","4.6.27","4.6.28","4.6.29","4.6.3","4.6.30","4.6.31","4.6.32","4.6.4","4.6.5","4.6.6","4.6.7","4.6.8","4.6.9","4.8.0","4.8.1","4.8.10","4.8.100","4.8.101","4.8.102","4.8.103","4.8.104","4.8.105","4.8.106","4.8.107","4.8.108","4.8.109","4.8.11","4.8.110","4.8.111","4.8.12","4.8.13","4.8.14","4.8.15","4.8.16","4.8.17","4.8.19","4.8.2","4.8.20","4.8.21","4.8.22","4.8.23","4.8.24","4.8.25","4.8.26","4.8.27","4.8.28","4.8.29","4.8.3","4.8.30","4.8.31","4.8.32","4.8.33","4.8.34","4.8.35","4.8.36","4.8.37","4.8.38","4.8.39","4.8.4","4.8.40","4.8.41","4.8.42","4.8.43","4.8.44","4.8.45","4.8.46","4.8.47","4.8.48","4.8.49","4.8.5","4.8.50","4.8.51","4.8.52","4.8.53","4.8.54","4.8.55","4.8.56","4.8.57","4.8.58","4.8.59","4.8.6","4.8.60","4.8.61","4.8.62","4.8.63","4.8.64","4.8.65","4.8.66","4.8.67","4.8.68","4.8.69","4.8.7","4.8.70","4.8.71","4.8.72","4.8.73","4.8.74","4.8.75","4.8.76","4.8.77","4.8.78","4.8.79","4.8.8","4.8.80","4.8.81","4.8.82","4.8.83","4.8.84","4.8.85","4.8.86","4.8.87","4.8.88","4.8.89","4.8.9","4.8.90","4.8.91","4.8.92","4.8.93","4.8.94","4.8.95","4.8.96","4.8.97","4.8.98"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"io.github.classgraph:classgraph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.8.83"},{"fixed":"4.8.83.rhlw-00001"}]}],"versions":["4.8.83"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"io.github.classgraph:classgraph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.36.rhlw-00001"}]}],"versions":["4.0.0","4.0.0-beta-11","4.0.0-beta-12","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.0.7","4.1.0","4.1.1","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6","4.1.7","4.2.0","4.2.1","4.2.10","4.2.11","4.2.12","4.2.2","4.2.3","4.2.4","4.2.5","4.2.6","4.2.7","4.2.8","4.2.9","4.3.0","4.3.1","4.4.0","4.4.1","4.4.10","4.4.11","4.4.12","4.4.2","4.4.3","4.4.4","4.4.5","4.4.6","4.4.7","4.4.8","4.4.9","4.6.0","4.6.1","4.6.10","4.6.11","4.6.12","4.6.13","4.6.14","4.6.15","4.6.16","4.6.17","4.6.18","4.6.19","4.6.2","4.6.20","4.6.21","4.6.22","4.6.23","4.6.24","4.6.25","4.6.26","4.6.27","4.6.28","4.6.29","4.6.3","4.6.30","4.6.31","4.6.32","4.6.4","4.6.5","4.6.6","4.6.7","4.6.8","4.6.9","4.8.0","4.8.1","4.8.10","4.8.11","4.8.12","4.8.13","4.8.14","4.8.15","4.8.16","4.8.17","4.8.19","4.8.2","4.8.20","4.8.21","4.8.22","4.8.23","4.8.24","4.8.25","4.8.26","4.8.27","4.8.28","4.8.29","4.8.3","4.8.30","4.8.31","4.8.32","4.8.33","4.8.34","4.8.35","4.8.36","4.8.4","4.8.5","4.8.6","4.8.7","4.8.8","4.8.9"]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.io.github.classgraph:classgraph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.21-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.github.classgraph:classgraph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.21-aikido.1"}]}]}],"products":[{"vendor":"classgraph","product":"classgraph"}],"references":[{"url":"https://github.com/classgraph/classgraph/releases/tag/classgraph-4.8.112","tags":["x_transferred","web"]},{"url":"https://github.com/classgraph/classgraph/commit/681362ad6b0b9d9abaffb2e07099ce54d7a41fa3","tags":["x_transferred","fix","web"]},{"url":"https://github.com/classgraph/classgraph/pull/539","tags":["x_transferred","fix","web"]},{"url":"https://docs.r3.com/en/platform/corda/4.8/enterprise/release-notes-enterprise.html","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47621","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-v2xm-76pq-phcf","tags":["advisory"]},{"url":"https://github.com/classgraph/classgraph","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-47621","description":"ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.","status":"published","published":"2024-06-21T00:00:00Z","modified":"2025-03-13T20:37:30.778Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:32:55.905855Z"}],"euvd":[{"id":"EUVD-2024-2166","description":"ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.","status":"published","published":"2024-06-21T00:00:00Z","modified":"2025-03-13T20:37:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T20:53:03.669796Z"}],"ghsa":[{"id":"GHSA-v2xm-76pq-phcf","title":"ClassGraph XML External Entity Reference","description":"ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.","status":"published","published":"2024-06-21T06:31:12Z","modified":"2024-08-09T05:03:43Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:37:59.336921Z"}],"nvd":[{"id":"CVE-2021-47621","description":"ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.","status":"published","published":"2024-06-21T06:15:10.487Z","modified":"2026-06-17T04:18:10.92Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:07:08.629518Z"}],"osv":[{"id":"CVE-2021-47621","description":"ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.","status":"published","published":"2024-06-21T06:15:10.487Z","modified":"2026-10-20T14:35:22.003406935Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:22.470367Z"},{"id":"GHSA-v2xm-76pq-phcf","title":"ClassGraph XML External Entity Reference","description":"ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.","status":"published","published":"2024-06-21T06:31:12Z","modified":"2026-09-10T03:50:15.914793485Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:56.639206Z"},{"id":"RHLW-2026-27d595c7dc400686","title":"Lightwell Security Advisory: classgraph 4.8.83.rhlw-00001","description":"Red Hat Lightwell has released io.github.classgraph:classgraph 4.8.83.rhlw-00001 with a backported security fix.\n\nCVE-2021-47621: ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.\n\nThis patched artifact is a drop-in replacement for io.github.classgraph:classgraph 4.8.83 from Maven Central.","status":"published","published":"2026-10-08T19:45:34Z","modified":"2026-10-29T14:30:06.049744767Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-9bd677f780e42d38","title":"Lightwell Security Advisory: classgraph 4.8.36.rhlw-00001","description":"Red Hat Lightwell has released io.github.classgraph:classgraph 4.8.36.rhlw-00001 with a backported security fix.\n\nCVE-2021-47621: ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.\n\nThis patched artifact is a drop-in replacement for io.github.classgraph:classgraph 4.8.36 from Maven Central.","status":"published","published":"2026-10-08T19:45:33Z","modified":"2026-10-27T04:00:15.661693104Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"ROOT-APP-MAVEN-CVE-2021-47621","title":"CVE-2021-47621 in io.root.io.github.classgraph:classgraph - Patched by Root","description":"Root has patched CVE-2021-47621 in the io.root.io.github.classgraph:classgraph package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-07-17T10:51:28Z","modified":"2026-07-17T12:15:23.822436431Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}