-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from insecure defaults in XMLUnit's XSLT processing configuration. The key evidence is in the commit diff showing the Default instance was modified to add .withExtensionFunctionsDisabled() in 2.10.0. Prior versions used a configuration that only disabled DTD loading .withDTDLoadingDisabled() but left extension functions enabled. This matches the vulnerability description about missing protection against XSLT extension function execution. The Default instance is the primary configuration used for transformations unless explicitly overridden, making it the root cause of the insecure default.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xmlunit:xmlunit-core | maven | < 2.10.0 | 2.10.0 |
KEV Misses 88% of Exploited CVEs- Get the report