Lightwell Security Advisory: xmlunit-assertj3 2.8.4.rhlw-00001

{
  "id": "4ec1336b3af6ac3128642ae9331ecfc9f5c1b92a66dbbef9bfd88de14ca89289",
  "url": "https://osv.dev/vulnerability/RHLW-2026-de2bb03e40c2ec86",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Lightwell Security Advisory: xmlunit-assertj3 2.8.4.rhlw-00001",
    "summary": "Red Hat Lightwell has released org.xmlunit:xmlunit-assertj3 2.8.4.rhlw-00001 with a backported security fix. CVE-2024-31573: XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled. This patched artifact is a drop-in replacement for org.xmlunit:xmlunit-assertj3 2.8.4 from Maven Central.",
    "evidence": "osv:RHLW-2026-de2bb03e40c2ec86",
    "products": [
      {
        "name": {
          "value": "org.xmlunit:xmlunit-assertj3",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "2.8.4.rhlw-00001",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": [
          {
            "value": "2.8.1",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.8.2",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.8.3",
            "evidence": "/affected/0/versions"
          },
          {
            "value": "2.8.4",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "RHLW-2026-de2bb03e40c2ec86",
      "aliases": [
        "RHLW-2026-de2bb03e40c2ec86"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "2.8.4.rhlw-00001"
                }
              ]
            }
          ],
          "package": {
            "name": "org.xmlunit:xmlunit-assertj3",
            "purl": "pkg:maven/org.xmlunit/xmlunit-assertj3",
            "ecosystem": "Red Hat Lightwell:Maven"
          },
          "versions": [
            "2.8.1",
            "2.8.2",
            "2.8.3",
            "2.8.4"
          ],
          "database_specific": {
            "source": "https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-de2bb03e40c2ec86.json",
            "lightwell": {
              "repository_url": "https://packages.redhat.com/lightwell/java/remediated/",
              "remediated_version": "2.8.4.rhlw-00001",
              "backport_base_version": "2.8.4"
            }
          }
        }
      ],
      "modified": "2026-10-27T04:00:17.365233171Z",
      "provider": "osv",
      "upstream": [
        "CVE-2024-31573",
        "GHSA-chfm-68vv-pvw5"
      ],
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31573.json",
        "https://github.com/advisories/GHSA-chfm-68vv-pvw5",
        "https://nvd.nist.gov/vuln/detail/CVE-2024-31573",
        "https://github.com/xmlunit/xmlunit/issues/264",
        "https://github.com/xmlunit/xmlunit/commit/b81d48b71dfd2868bdfc30a3e17ff973f32bc15b"
      ]
    },
    "related_cves": [
      {
        "value": "CVE-2024-31573",
        "evidence": "/upstream"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 460142,
  "published_at": "2026-10-08T19:46:25+00:00"
}