{"id":"CVE-2024-31573","aliases":["CLSA-2024-1727136010","CLSA-2025-1740614445","CLSA-2026-1793128026","CLSA-2026-1793834532","EUVD-2024-1578","GHSA-chfm-68vv-pvw5","OESA-2025-1966","OESA-2025-1967","OESA-2025-1968","OESA-2025-1969","OESA-2025-1970","RHLW-2026-bf51d193d76de6ef","RHLW-2026-de2bb03e40c2ec86","RHLW-2026-e5adae5b227184e1","RHLW-2026-ea9f6fe6976a39aa","ROOT-APP-MAVEN-CVE-2024-31573","UBUNTU-CVE-2024-31573"],"status":"published","title":"XMLUnit for Java has Insecure Defaults when Processing XSLT Stylesheets","description":"XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.","severity":{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0032,"percentile":0.25274,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-669"],"published":"2024-05-01T16:40:01Z","modified":"2026-11-05T07:00:39Z","fixes":[{"ecosystem":"Maven","package":"org.xmlunit:xmlunit-core","fixed_in":["2.10.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.xmlunit:xmlunit-core","fixed_in":["2.9.0.tuxcare","2.9.1.tuxcare","2.6.3-tuxcare.1","2.7.0-tuxcare.2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"xmlunit","fixed_in":["2.7.0-2.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"xmlunit","fixed_in":["2.7.0-3.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"xmlunit","fixed_in":["2.7.0-3.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"xmlunit","fixed_in":["2.7.0-3.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"xmlunit","fixed_in":["2.7.0-2.oe2203sp3"],"sources":["osv"]},{"ecosystem":"Red Hat Lightwell:Maven","package":"org.xmlunit:xmlunit-assertj3","fixed_in":["2.9.1.rhlw-00002","2.8.4.rhlw-00001"],"sources":["osv"]},{"ecosystem":"Red Hat Lightwell:Maven","package":"org.xmlunit:xmlunit-core","fixed_in":["2.9.1.rhlw-00002","2.8.4.rhlw-00001"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.xmlunit:xmlunit-core","fixed_in":["2.9.1-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.xmlunit:xmlunit-core","fixed_in":["2.9.1-aikido.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.xmlunit:xmlunit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.xmlunit:xmlunit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.0"},{"fixed":"2.9.0.tuxcare"}]}],"versions":["2.9.0"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.xmlunit:xmlunit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.1"},{"fixed":"2.9.1.tuxcare"}]}],"versions":["2.9.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.xmlunit:xmlunit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.3"},{"fixed":"2.6.3-tuxcare.1"}]}],"versions":["2.6.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.xmlunit:xmlunit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.0-tuxcare.2"}]}],"versions":["2.7.0","2.7.0-tuxcare.1"]},{"source":"osv","ecosystem":"Maven","package":"org.xmlunit:xmlunit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0"}]}],"versions":["2.0.0","2.0.0-alpha-02","2.0.0-alpha-03","2.0.0-alpha-04","2.1.0","2.1.1","2.2.0","2.2.1","2.3.0","2.4.0","2.5.0","2.5.1","2.6.0","2.6.1","2.6.2","2.6.3","2.6.4","2.7.0","2.8.0","2.8.1","2.8.2","2.8.3","2.8.4","2.9.0","2.9.1"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"xmlunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-2.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"xmlunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-3.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"xmlunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-3.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"xmlunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-3.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"xmlunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.0-2.oe2203sp3"}]}]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.xmlunit:xmlunit-assertj3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.1"},{"fixed":"2.9.1.rhlw-00002"}]}],"versions":["2.9.1"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.xmlunit:xmlunit-assertj3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4.rhlw-00001"}]}],"versions":["2.8.1","2.8.2","2.8.3","2.8.4"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.xmlunit:xmlunit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.1"},{"fixed":"2.9.1.rhlw-00002"}]}],"versions":["2.9.1"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.xmlunit:xmlunit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4.rhlw-00001"}]}],"versions":["2.0.0","2.0.0-alpha-02","2.0.0-alpha-03","2.0.0-alpha-04","2.1.0","2.1.1","2.2.0","2.2.1","2.3.0","2.4.0","2.5.0","2.5.1","2.6.0","2.6.1","2.6.2","2.6.3","2.6.4","2.7.0","2.8.0","2.8.1","2.8.2","2.8.3","2.8.4"]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.xmlunit:xmlunit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.xmlunit:xmlunit-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-aikido.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xmlunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xmlunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"xmlunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-1","1.6-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xmlunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xmlunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xmlunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xmlunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xmlunit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6-2","1.6-2build1"]}],"products":[{"vendor":"xmlunit","product":"xmlunit for java"}],"references":[{"url":"https://github.com/advisories/GHSA-chfm-68vv-pvw5","tags":["advisory","report"]},{"url":"https://github.com/xmlunit/xmlunit/issues/264","tags":["exploit","report","web"]},{"url":"https://github.com/xmlunit/xmlunit/commit/b81d48b71dfd2868bdfc30a3e17ff973f32bc15b","tags":["fix","web","report"]},{"url":"https://github.com/xmlunit/xmlunit/security/advisories/GHSA-chfm-68vv-pvw5","tags":["web"]},{"url":"https://docs.oracle.com/en/java/javase/22/security/java-api-xml-processing-jaxp-security-guide.html#GUID-E345AA09-801E-4B95-B83D-7F0C452538AA","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31573.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31573","tags":["advisory"]},{"url":"https://github.com/xmlunit/xmlunit","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1966","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1967","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1968","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1969","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1970","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-31573","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-31573","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-31573","description":"XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.","status":"published","published":"2025-10-17T00:00:00Z","modified":"2025-10-17T19:04:05.637Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-669"],"updated_at":"2026-11-02T14:34:14.308905Z"}],"euvd":[{"id":"EUVD-2024-1578","description":"XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.","status":"published","published":"2025-10-17T00:00:00Z","modified":"2025-10-17T19:04:05Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:31:30.508055Z"}],"ghsa":[{"id":"GHSA-chfm-68vv-pvw5","title":"XMLUnit for Java has Insecure Defaults when Processing XSLT Stylesheets","description":"### Impact\nWhen performing XSLT transformations XMLUnit for Java did not disable XSLT extension functions by default. Depending on the XSLT processor being used this could allow arbitrary code to be executed when XMLUnit is used to transform data with a stylesheet who's source can not be trusted. If the stylesheet can be provided externally this may even lead to a remote code execution.\n\n## Patches\nUsers are advised to upgrade to XMLUnit for Java 2.10.0 where the default has been changed by means of https://github.com/xmlunit/xmlunit/commit/b81d48b71dfd2868bdfc30a3e17ff973f32bc15b\n\n### Workarounds\nXMLUnit's main use-case is performing tests on code that generates or processes XML. Most users will not use it to perform arbitrary XSLT transformations.\n\nUsers running XSLT transformations with untrusted stylesheets should explicitly use XMLUnit's APIs to pass in a pre-configured TraX `TransformerFactory` with extension functions disabled via features and attributes. The required `setFactory` or `setTransformerFactory` methods have been available since XMLUnit for Java 2.0.0.\n\n### References\n[Bug Report](https://github.com/xmlunit/xmlunit/issues/264)\n[JAXP Security Guide](https://docs.oracle.com/en/java/javase/22/security/java-api-xml-processing-jaxp-security-guide.html#GUID-E345AA09-801E-4B95-B83D-7F0C452538AA)\n","status":"published","published":"2024-05-01T16:40:01Z","modified":"2024-05-01T16:40:05Z","updated_at":"2026-11-02T14:37:48.08826Z"}],"nvd":[{"id":"CVE-2024-31573","description":"XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.","status":"published","published":"2025-10-17T19:15:36.627Z","modified":"2026-10-02T00:10:00.18Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-669"],"updated_at":"2026-11-02T14:10:47.444899Z"}],"osv":[{"id":"CVE-2024-31573","description":"XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.","status":"published","published":"2025-10-17T00:00:00Z","modified":"2026-11-11T13:22:49.205109163Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-669"],"updated_at":"2026-11-11T03:22:28.447808Z"},{"id":"OESA-2025-1966","title":"xmlunit security update","description":"Security Fix(es):\n\nA vulnerability was found in xmlunit-core. It has been declared as problematic.As an impact it is known to affect confidentiality, integrity, and availability.Upgrading to version 2.10.0 eliminates this vulnerability.(CVE-2024-31573)","status":"published","published":"2025-08-08T11:09:03Z","modified":"2026-08-18T01:18:56.444450591Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1967","title":"xmlunit security update","description":"Security Fix(es):\n\nA vulnerability was found in xmlunit-core. It has been declared as problematic.As an impact it is known to affect confidentiality, integrity, and availability.Upgrading to version 2.10.0 eliminates this vulnerability.(CVE-2024-31573)","status":"published","published":"2025-08-08T11:09:03Z","modified":"2026-08-18T01:18:57.207802773Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1968","title":"xmlunit security update","description":"Security Fix(es):\n\nA vulnerability was found in xmlunit-core. It has been declared as problematic.As an impact it is known to affect confidentiality, integrity, and availability.Upgrading to version 2.10.0 eliminates this vulnerability.(CVE-2024-31573)","status":"published","published":"2025-08-08T11:09:03Z","modified":"2026-08-18T01:18:55.942167509Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1969","title":"xmlunit security update","description":"Security Fix(es):\n\nA vulnerability was found in xmlunit-core. It has been declared as problematic.As an impact it is known to affect confidentiality, integrity, and availability.Upgrading to version 2.10.0 eliminates this vulnerability.(CVE-2024-31573)","status":"published","published":"2025-08-08T11:09:03Z","modified":"2026-08-18T01:18:55.960590142Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-1970","title":"xmlunit security update","description":"Security Fix(es):\n\nA vulnerability was found in xmlunit-core. It has been declared as problematic.As an impact it is known to affect confidentiality, integrity, and availability.Upgrading to version 2.10.0 eliminates this vulnerability.(CVE-2024-31573)","status":"published","published":"2025-08-08T11:09:03Z","modified":"2026-08-18T01:18:56.461498557Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"RHLW-2026-bf51d193d76de6ef","title":"Lightwell Security Advisory: xmlunit-assertj3 2.9.1.rhlw-00002","description":"Red Hat Lightwell has released org.xmlunit:xmlunit-assertj3 2.9.1.rhlw-00002 with a backported security fix.\n\nCVE-2024-31573: XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.\n\nThis patched artifact is a drop-in replacement for org.xmlunit:xmlunit-assertj3 2.9.1 from Maven Central.","status":"published","published":"2026-10-08T19:46:25Z","modified":"2026-10-29T14:30:02.399865888Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-de2bb03e40c2ec86","title":"Lightwell Security Advisory: xmlunit-assertj3 2.8.4.rhlw-00001","description":"Red Hat Lightwell has released org.xmlunit:xmlunit-assertj3 2.8.4.rhlw-00001 with a backported security fix.\n\nCVE-2024-31573: XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.\n\nThis patched artifact is a drop-in replacement for org.xmlunit:xmlunit-assertj3 2.8.4 from Maven Central.","status":"published","published":"2026-10-08T19:46:25Z","modified":"2026-10-27T04:00:17.365233171Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:59.135214Z"},{"id":"RHLW-2026-e5adae5b227184e1","title":"Lightwell Security Advisory: xmlunit-core 2.9.1.rhlw-00002","description":"Red Hat Lightwell has released org.xmlunit:xmlunit-core 2.9.1.rhlw-00002 with a backported security fix.\n\nCVE-2024-31573: XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.\n\nThis patched artifact is a drop-in replacement for org.xmlunit:xmlunit-core 2.9.1 from Maven Central.","status":"published","published":"2026-10-12T19:53:23Z","modified":"2026-10-29T14:30:09.035845649Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:59.135214Z"},{"id":"RHLW-2026-ea9f6fe6976a39aa","title":"Lightwell Security Advisory: xmlunit-core 2.8.4.rhlw-00001","description":"Red Hat Lightwell has released org.xmlunit:xmlunit-core 2.8.4.rhlw-00001 with a backported security fix.\n\nCVE-2024-31573: XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.\n\nThis patched artifact is a drop-in replacement for org.xmlunit:xmlunit-core 2.8.4 from Maven Central.","status":"published","published":"2026-10-12T19:53:25Z","modified":"2026-10-27T04:00:13.840104562Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:59.135214Z"},{"id":"UBUNTU-CVE-2024-31573","description":"XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.","status":"published","published":"2025-10-17T19:15:00Z","modified":"2026-10-17T12:56:35.203964432Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"CLSA-2024-1727136010","title":"TuxCare security update for org.xmlunit:xmlunit-core (1 CVE)","description":"TuxCare rebuilt org.xmlunit:xmlunit-core to address 1 CVE. Fixed in 2.9.0.tuxcare.","status":"published","published":"2026-08-04T14:52:03Z","modified":"2026-11-02T19:45:06.081319223Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2025-1740614445","title":"TuxCare security update for org.xmlunit:xmlunit-core (1 CVE)","description":"TuxCare rebuilt org.xmlunit:xmlunit-core to address 1 CVE. Fixed in 2.9.1.tuxcare.","status":"published","published":"2026-08-04T14:52:03Z","modified":"2026-11-02T19:45:05.092500342Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1793128026","title":"TuxCare security update for org.xmlunit:xmlunit-core (1 CVE)","description":"TuxCare rebuilt org.xmlunit:xmlunit-core to address 1 CVE. Fixed in 2.6.3-tuxcare.1.","status":"published","published":"2026-10-27T19:07:06Z","modified":"2026-11-02T19:46:31.895395513Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793834532","title":"TuxCare security update for org.xmlunit:xmlunit-core (1 CVE)","description":"TuxCare rebuilt org.xmlunit:xmlunit-core to address 1 CVE. Fixed in 2.7.0-tuxcare.2.","status":"published","published":"2026-11-05T00:22:12Z","modified":"2026-11-05T07:00:39.176692048Z","updated_at":"2026-11-05T07:10:31.343344Z"},{"id":"GHSA-chfm-68vv-pvw5","title":"XMLUnit for Java has Insecure Defaults when Processing XSLT Stylesheets","description":"### Impact\nWhen performing XSLT transformations XMLUnit for Java did not disable XSLT extension functions by default. Depending on the XSLT processor being used this could allow arbitrary code to be executed when XMLUnit is used to transform data with a stylesheet who's source can not be trusted. If the stylesheet can be provided externally this may even lead to a remote code execution.\n\n## Patches\nUsers are advised to upgrade to XMLUnit for Java 2.10.0 where the default has been changed by means of https://github.com/xmlunit/xmlunit/commit/b81d48b71dfd2868bdfc30a3e17ff973f32bc15b\n\n### Workarounds\nXMLUnit's main use-case is performing tests on code that generates or processes XML. Most users will not use it to perform arbitrary XSLT transformations.\n\nUsers running XSLT transformations with untrusted stylesheets should explicitly use XMLUnit's APIs to pass in a pre-configured TraX `TransformerFactory` with extension functions disabled via features and attributes. The required `setFactory` or `setTransformerFactory` methods have been available since XMLUnit for Java 2.0.0.\n\n### References\n[Bug Report](https://github.com/xmlunit/xmlunit/issues/264)\n[JAXP Security Guide](https://docs.oracle.com/en/java/javase/22/security/java-api-xml-processing-jaxp-security-guide.html#GUID-E345AA09-801E-4B95-B83D-7F0C452538AA)\n","status":"published","published":"2024-05-01T16:40:01Z","modified":"2024-12-05T05:28:04.51863Z","updated_at":"2026-11-02T15:46:45.28161Z"},{"id":"ROOT-APP-MAVEN-CVE-2024-31573","title":"CVE-2024-31573 in io.root.org.xmlunit:xmlunit-core - Patched by Root","description":"Root has patched CVE-2024-31573 in the io.root.org.xmlunit:xmlunit-core package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-06-23T10:07:07Z","modified":"2026-06-23T12:30:13.373226194Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}