High
Security advisory
corenlp is vulnerable to Improper Restriction of XML External Entity Reference
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-3869
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:45 UTC · Revision 1
Source evidence
corenlp is vulnerable to Improper Restriction of XML External Entity Reference
osv:CVE-2021-3869
Complete source record
{
"id": "74f3dc118a5eb4fbf33fe54d2a81eb8b4a3774df92106e298d370f36d0846bf9",
"url": "https://osv.dev/vulnerability/CVE-2021-3869",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-3869",
"summary": "corenlp is vulnerable to Improper Restriction of XML External Entity Reference",
"evidence": "osv:CVE-2021-3869",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2021-3869",
"aliases": [
"CVE-2021-3869",
"GHSA-8gf7-w3cp-gfh3"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/stanfordnlp/corenlp",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "147e45894f007caf7dd5c7f7677bcfcf95a38e94"
},
{
"fixed": "5d83f1e8482ca304db8be726cad89554c88f136a"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:stanford:corenlp:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "4.3.0"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "5d83f1e8482ca304db8be726cad89554c88f136a"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v4.3.0",
"v4.2.2",
"v4.2.0",
"v4.1.0",
"v3.9.2b",
"v3.9.2",
"v3.9.1",
"v3.8.0",
"v3.7.0",
"v3.6.0",
"v3.5.2",
"v3.5.1",
"v3.5.0",
"v3.4.1",
"v3.4.0",
"v3.3.1",
"v3.3.0",
"v1.3.6",
"v1.3.5"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3869.json",
"vanir_signatures": [
{
"id": "CVE-2021-3869-03736584",
"digest": {
"length": 211,
"function_hash": "282228415339455438273734548232919417045"
},
"source": "https://github.com/stanfordnlp/corenlp/commit/5d83f1e8482ca304db8be726cad89554c88f136a",
"target": {
"file": "src/edu/stanford/nlp/util/XMLUtils.java",
"function": "readDocumentFromString"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-3869-0b9d4f2e",
"digest": {
"length": 974,
"function_hash": "339539532999718011766812238207211020505"
},
"source": "https://github.com/stanfordnlp/corenlp/commit/5d83f1e8482ca304db8be726cad89554c88f136a",
"target": {
"file": "src/edu/stanford/nlp/util/XMLUtils.java",
"function": "getTagElementTriplesFromFileNumBoundedSAXException"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-3869-0f321a2a",
"digest": {
"length": 267,
"function_hash": "133618988560491517863661952410748659093"
},
"source": "https://github.com/stanfordnlp/corenlp/commit/5d83f1e8482ca304db8be726cad89554c88f136a",
"target": {
"file": "src/edu/stanford/nlp/util/XMLUtils.java",
"function": "readDocumentFromFile"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-3869-288456af",
"digest": {
"length": 839,
"function_hash": "57875381660395587146500002792859507625"
},
"source": "https://github.com/stanfordnlp/corenlp/commit/5d83f1e8482ca304db8be726cad89554c88f136a",
"target": {
"file": "src/edu/stanford/nlp/util/XMLUtils.java",
"function": "getValidatingXmlParser"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-3869-47d2fb68",
"digest": {
"threshold": 0.9,
"line_hashes": [
"113721122306961811307245648912784140951",
"15380452587329287648139737907248756542",
"67261017168127998554694966176536520105",
"82236319493109517157520277073675849847",
"72099698087150977088053670808564442814",
"140280342361643877020607900895017066103",
"176175501865156546835651553731543194374",
"131018909406202936379328885969984351084",
"130652315381450011727468856986671065747",
"140280342361643877020607900895017066103",
"176175501865156546835651553731543194374",
"314058722991527430007903051163367355872",
"114923087756976839571355317777718125208",
"140280342361643877020607900895017066103",
"176175501865156546835651553731543194374",
"288204655518965274734603104663230841055",
"35688767085801854987539247536046927413",
"213972472363990541398999870938382036360",
"84590011855248043900451544782037181067",
"176504653225379522938058681059997409753",
"82315799528386862952629269159980388374",
"258465410988051223891552779164057422124",
"236505832634362512688958274748043291174",
"271343112764026587792505873989817992095",
"213756788319461207989688851556298405952",
"179161810648301094875019735716629057721",
"120001685974256268313882429731009057167",
"255524276254612195828047085873515440046",
"27556299056242409823784886435869375651",
"181697664564629601600919907052829826187",
"340237840694337195563965595212234174254"
]
},
"source": "https://github.com/stanfordnlp/corenlp/commit/5d83f1e8482ca304db8be726cad89554c88f136a",
"target": {
"file": "src/edu/stanford/nlp/util/XMLUtils.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-3869-4f9e6373",
"digest": {
"length": 853,
"function_hash": "97708914565267883729877422803920359090"
},
"source": "https://github.com/stanfordnlp/corenlp/commit/5d83f1e8482ca304db8be726cad89554c88f136a",
"target": {
"file": "src/edu/stanford/nlp/util/XMLUtils.java",
"function": "getTextContentFromTagsFromFileSAXException"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-3869-8e366bfb",
"digest": {
"length": 262,
"function_hash": "141040611034541970636184340523254228131"
},
"source": "https://github.com/stanfordnlp/corenlp/commit/5d83f1e8482ca304db8be726cad89554c88f136a",
"target": {
"file": "src/edu/stanford/nlp/time/XMLUtils.java",
"function": "parseElement"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-3869-a5d9e4b4",
"digest": {
"threshold": 0.9,
"line_hashes": [
"191152860695934471935233419423974690325",
"312008131744248285121188310548798799410",
"162011497828968531108310790939962780940",
"76589103331221181946981564661371888675",
"227888927651163007866069655212143990451",
"289723381403125099761902686883332123565",
"176677960171810263803004843855572462575",
"54288892236125364699576036506607470091",
"180752849411623004677800510525005492403",
"159792508167345579893610196532019324736"
]
},
"source": "https://github.com/stanfordnlp/corenlp/commit/5d83f1e8482ca304db8be726cad89554c88f136a",
"target": {
"file": "src/edu/stanford/nlp/time/XMLUtils.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-3869-bab5fc67",
"digest": {
"length": 724,
"function_hash": "317754328735163369111994239802752733032"
},
"source": "https://github.com/stanfordnlp/corenlp/commit/5d83f1e8482ca304db8be726cad89554c88f136a",
"target": {
"file": "src/edu/stanford/nlp/util/XMLUtils.java",
"function": "getXmlParser"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-3869-bda732d7",
"digest": {
"length": 197,
"function_hash": "132369660363934791855361247269377252760"
},
"source": "https://github.com/stanfordnlp/corenlp/commit/5d83f1e8482ca304db8be726cad89554c88f136a",
"target": {
"file": "src/edu/stanford/nlp/time/XMLUtils.java",
"function": "createDocument"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-3869-e7629b96",
"digest": {
"length": 525,
"function_hash": "294075203263025272792390295018518329801"
},
"source": "https://github.com/stanfordnlp/corenlp/commit/5d83f1e8482ca304db8be726cad89554c88f136a",
"target": {
"file": "src/edu/stanford/nlp/util/XMLUtils.java",
"function": "getTagElementsFromFileSAXException"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:26:16Z"
}
}
],
"modified": "2026-10-20T14:26:16.933941410Z",
"provider": "osv",
"references": [
"https://github.com/stanfordnlp/corenlp/commit/5d83f1e8482ca304db8be726cad89554c88f136a",
"https://huntr.dev/bounties/2f8baf6c-14b3-420d-8ede-9805797cd324"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2021-3869",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388984,
"published_at": "2021-10-19T13:15:11.773+00:00"
}