CVE-2026-24400
XML External Entity (XXE) Vulnerability in AssertJ XML Formatter
Publication date: 2026-01-26
Last updated on: 2026-03-09
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| assertj | assertj | From 1.4.0 (inc) to 3.27.7 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-611 | The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an XML External Entity (XXE) issue in AssertJ versions from 1.4.0 up to before 3.27.7. It occurs in the XmlStringPrettyFormatter class's toXmlDocument(String) method, which initializes XML parsing without disabling DTDs or external entities. When untrusted XML input is processed using the isXmlEqualTo(CharSequence) assertion or xmlPrettyFormat(String), an attacker can exploit this to read arbitrary local files, perform Server-Side Request Forgery (SSRF), or cause Denial of Service via entity expansion attacks.
How can this vulnerability impact me? :
If your application uses affected versions of AssertJ and processes untrusted XML input with the vulnerable methods, an attacker could read sensitive local files (like /etc/passwd), perform SSRF attacks to access internal network resources, or cause Denial of Service by exploiting entity expansion. This can lead to data exposure, network compromise, or service disruption.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should: 1) Replace the use of isXmlEqualTo(CharSequence) with XMLUnit, 2) Upgrade AssertJ to version 3.27.7 or later, or 3) Avoid using isXmlEqualTo(CharSequence) or XmlStringPrettyFormatter with untrusted XML input.