CVE-2024-31573

State: Published
Severity: 4.0 Medium
Published: Oct 17, 2025
Updated: Oct 17, 2025
Reserved: Apr 5, 2024

Description

XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.

Scores

CVSS	Score	Vector	Source
3.1	4.0 Medium	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N	mitre

Weaknesses

CWE-669 Incorrect Resource Transfer Between Spheres

Affected Products

Product	Versions
XMLUnit for JavaXMLUnit	2.0.0 to before 2.10.0Affected

References

https://github.com/advisories/GHSA-chfm-68vv-pvw5
https://github.com/xmlunit/xmlunit/issues/264
https://github.com/xmlunit/xmlunit/commit/b81d48b71dfd2868bdfc30a3e17ff973f32bc15b

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.