Medium
xmlunit — security advisory
XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.
- Products
- xmlunit
- Affected versions
- 1.6-1, 1.6-2, 1.6-2build1
- Fixed versions
- Not specified
- CVEs
- CVE-2024-31573
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 01:07 UTC · Revision 1
Source evidence
XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.
osv:UBUNTU-CVE-2024-31573
xmlunit
Fixed versions: Not specified
xmlunit
Fixed versions: Not specified
xmlunit
Fixed versions: Not specified
xmlunit
Fixed versions: Not specified
xmlunit
Fixed versions: Not specified
xmlunit
Fixed versions: Not specified
xmlunit
Fixed versions: Not specified
xmlunit
Fixed versions: Not specified
Complete source record
{
"id": "219de192b393a2b23bc102eea558e5b0a38edfc8236b8c4b91b3f9adf47adc7c",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2024-31573",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2024-31573",
"summary": "XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.",
"evidence": "osv:UBUNTU-CVE-2024-31573",
"products": [
{
"name": {
"value": "xmlunit",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.6-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "xmlunit",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.6-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "xmlunit",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.6-1",
"evidence": "/affected/2/versions"
},
{
"value": "1.6-2",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "xmlunit",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.6-2",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "xmlunit",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.6-2",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "xmlunit",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.6-2",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "xmlunit",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.6-2build1",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "xmlunit",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.6-2",
"evidence": "/affected/7/versions"
},
{
"value": "1.6-2build1",
"evidence": "/affected/7/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "UBUNTU-CVE-2024-31573",
"aliases": [
"UBUNTU-CVE-2024-31573"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "xmlunit",
"purl": "pkg:deb/ubuntu/xmlunit?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"1.6-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-31573.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libxmlunit-java",
"binary_version": "1.6-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "xmlunit",
"purl": "pkg:deb/ubuntu/xmlunit?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"1.6-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-31573.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libxmlunit-java",
"binary_version": "1.6-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "xmlunit",
"purl": "pkg:deb/ubuntu/xmlunit?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"1.6-1",
"1.6-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-31573.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libxmlunit-java",
"binary_version": "1.6-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "xmlunit",
"purl": "pkg:deb/ubuntu/xmlunit?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"1.6-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-31573.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libxmlunit-java",
"binary_version": "1.6-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "xmlunit",
"purl": "pkg:deb/ubuntu/xmlunit?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"1.6-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-31573.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libxmlunit-java",
"binary_version": "1.6-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "xmlunit",
"purl": "pkg:deb/ubuntu/xmlunit?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"1.6-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-31573.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libxmlunit-java",
"binary_version": "1.6-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "xmlunit",
"purl": "pkg:deb/ubuntu/xmlunit?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"1.6-2build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-31573.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libxmlunit-java",
"binary_version": "1.6-2build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "xmlunit",
"purl": "pkg:deb/ubuntu/xmlunit?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"1.6-2",
"1.6-2build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-31573.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libxmlunit-java",
"binary_version": "1.6-2build1"
}
]
}
}
],
"modified": "2026-10-17T12:56:35.203964432Z",
"provider": "osv",
"upstream": [
"CVE-2024-31573"
],
"references": [
"https://ubuntu.com/security/CVE-2024-31573",
"https://www.cve.org/CVERecord?id=CVE-2024-31573",
"https://github.com/advisories/GHSA-chfm-68vv-pvw5",
"https://github.com/xmlunit/xmlunit/issues/264",
"https://github.com/xmlunit/xmlunit/commit/b81d48b71dfd2868bdfc30a3e17ff973f32bc15b"
]
},
"related_cves": [
{
"value": "CVE-2024-31573",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 355821,
"published_at": "2025-10-17T19:15:00+00:00"
}