CVE-2024-31573CWE-669

CVE-2024-31573

Medium · published October 17, 2025

CVSS v3.1

4.0

EPSS

Percentile

23.7

In the wild

Unconfirmed

What it is

XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.

The record

Technical detail

CVSS v3.1: 4.0 · MEDIUM
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00320 · 23.7th percentile
Weakness: CWE-669 · Incorrect Resource Transfer Between Spheres
Published: 2025-10-17T23:15Z

References (4)

https://github.com/advisories/GHSA-chfm-68vv-pvw5 · [email protected]https://github.com/xmlunit/xmlunit/commit/b81d48b71dfd2868bdfc30a3e17ff973f32bc15b · [email protected]https://github.com/xmlunit/xmlunit/issues/264 · [email protected]https://github.com/xmlunit/xmlunit/issues/264 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

17 OCT 00:00Z
XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because…
cvelistv5