Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-31573

Good to know:

icon
icon
icon

Date: October 16, 2025

When performing XSLT transformations XMLUnit for Java before 2.10.0 did not disable XSLT extension functions by default. Depending on the XSLT processor being used this could allow arbitrary code to be executed when XMLUnit is used to transform data with a stylesheet who's source can not be trusted. If the stylesheet can be provided externally this may even lead to a remote code execution.

Language: Java

Severity Score

Related Resources (8)

https://github.com/xmlunit/xmlunit
https://docs.oracle.com/en/java/javase/22/security/java-api-xml-processing-jaxp-security-guide.html#GUID-E345AA09-801E-4B95-B83D-7F0C452538AA
https://nvd.nist.gov/vuln/detail/CVE-2024-31573
https://github.com/advisories/GHSA-chfm-68vv-pvw5
https://github.com/xmlunit/xmlunit/issues/264
https://github.com/xmlunit/xmlunit/commit/b81d48b71dfd2868bdfc30a3e17ff973f32bc15b
https://github.com/xmlunit/xmlunit/security/advisories/GHSA-chfm-68vv-pvw5
https://www.mend.io/vulnerability-database/CVE-2024-31573

Severity Score

Weakness Type (CWE)

Incorrect Resource Transfer Between Spheres

CWE-669

Top Fix

icon

Upgrade Version

Upgrade to version org.xmlunit:xmlunit-core:2.10.0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): LOCAL
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): LOW
Availability (A): NONE

Do you need more information?

Contact Us