-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from insecure XML parser configuration in the NugetPackageCheckerVisitor constructor. The pre-patch code (v1.0) used DocumentBuilderFactory.newInstance().newDocumentBuilder() without security features, while the patched version (v1.1) explicitly sets disallow-doctype-decl=true. The test case added in the commit demonstrates XXE prevention by expecting parser errors when DOCTYPE is present. The constructor's XML parser initialization is the root cause of the XXE vulnerability as it processes untrusted packages.config files without proper safeguards.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:nuget | maven | < 1.1 | 1.1 |