CVE-2024-31573

Published: Oct 17, 2025Modified: Jun 17, 2026Deferred

4.0

Vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 1.4 / Impact: 2.5

Source: MITRE (Secondary)

Description

XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.

Related CWEs

CWE-669

Incorrect Resource Transfer Between Spheres

The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.

References (4)

https://github.com/advisories/GHSA-chfm-68vv-pvw5

Source: cve@mitre.org

https://github.com/xmlunit/xmlunit/commit/b81d48b71dfd2868bdfc30a3e17ff973f32bc15b

Source: cve@mitre.org

https://github.com/xmlunit/xmlunit/issues/264

Source: cve@mitre.org

https://github.com/xmlunit/xmlunit/issues/264

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.