Critical
Security advisory
corenlp is vulnerable to Improper Restriction of XML External Entity Reference
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-3878
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:45 UTC · Revision 1
Source evidence
corenlp is vulnerable to Improper Restriction of XML External Entity Reference
osv:CVE-2021-3878
Complete source record
{
"id": "447a32e0618e3c080780035a4170162b1400478604a7287c3aefe53cb4638153",
"url": "https://osv.dev/vulnerability/CVE-2021-3878",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-3878",
"summary": "corenlp is vulnerable to Improper Restriction of XML External Entity Reference",
"evidence": "osv:CVE-2021-3878",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2021-3878",
"aliases": [
"CVE-2021-3878",
"GHSA-5h9g-8xcv-qjq9"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/stanfordnlp/corenlp",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "4c28eb5f5e44381b4157aa4fcab72e9231ce42b8"
},
{
"fixed": "e5bbe135a02a74b952396751ed3015e8b8252e99"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:stanford:corenlp:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "4.3.1"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "e5bbe135a02a74b952396751ed3015e8b8252e99"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v4.2.2",
"v4.2.0",
"v4.1.0",
"v3.9.2b",
"v3.9.2",
"v3.9.1",
"v3.8.0",
"v3.7.0",
"v3.6.0",
"v3.5.2",
"v3.5.1",
"v3.5.0",
"v3.4.1",
"v3.4.0",
"v3.3.1",
"v3.3.0",
"v1.3.6",
"v1.3.5"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3878.json",
"vanir_signatures": [
{
"id": "CVE-2021-3878-7229d502",
"digest": {
"length": 1586,
"function_hash": "291074622600642610157368812944203434980"
},
"source": "https://github.com/stanfordnlp/corenlp/commit/e5bbe135a02a74b952396751ed3015e8b8252e99",
"target": {
"file": "src/edu/stanford/nlp/semgraph/semgrex/ssurgeon/Ssurgeon.java",
"function": "createPatternXMLDoc"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-3878-9813aae8",
"digest": {
"length": 526,
"function_hash": "113266199536841263999060233615632176269"
},
"source": "https://github.com/stanfordnlp/corenlp/commit/e5bbe135a02a74b952396751ed3015e8b8252e99",
"target": {
"file": "src/edu/stanford/nlp/ie/machinereading/common/DomReader.java",
"function": "readDocument"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-3878-9c0c6d9b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"43520721332826866978081389765769837818",
"311326111611860079278883770771580253757",
"284015593708485329815509971555724572621",
"201299330372787746440815065572931448919",
"174143996608599779934398090899519012840",
"171895115847832278626512948996122655481",
"27544422830202180997671230688218298402"
]
},
"source": "https://github.com/stanfordnlp/corenlp/commit/e5bbe135a02a74b952396751ed3015e8b8252e99",
"target": {
"file": "src/edu/stanford/nlp/ie/machinereading/common/DomReader.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-3878-c184250c",
"digest": {
"length": 863,
"function_hash": "195774482806396804331330397921589092113"
},
"source": "https://github.com/stanfordnlp/corenlp/commit/e5bbe135a02a74b952396751ed3015e8b8252e99",
"target": {
"file": "src/edu/stanford/nlp/semgraph/semgrex/ssurgeon/Ssurgeon.java",
"function": "readFromFile"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-3878-ef0b7437",
"digest": {
"threshold": 0.9,
"line_hashes": [
"32642060372119981804040651553716705297",
"126711288501821075352997964835856383955",
"272376512348212872158334304444166236833",
"340094259709667466320011249881867189768",
"31381996387163615903366194365175756201",
"161628023665971883443317856409843048974",
"338514437842053370218888284440184446337",
"249535337310361220095059048906446184235",
"22625991252588605524146076067212119259",
"239472623923091145564852860362663353398",
"167865824011085792938949664764790814940",
"313494352930947755695683903344783533648"
]
},
"source": "https://github.com/stanfordnlp/corenlp/commit/e5bbe135a02a74b952396751ed3015e8b8252e99",
"target": {
"file": "src/edu/stanford/nlp/semgraph/semgrex/ssurgeon/Ssurgeon.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:26:20Z"
}
}
],
"modified": "2026-10-20T14:26:20.571516219Z",
"provider": "osv",
"references": [
"https://github.com/stanfordnlp/corenlp/commit/e5bbe135a02a74b952396751ed3015e8b8252e99",
"https://huntr.dev/bounties/a11c889b-ccff-4fea-9e29-963a23a63dd2"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2021-3878",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388989,
"published_at": "2021-10-15T14:15:07.857+00:00"
}