{"id":"GHSA-rqfh-9r24-8c9r","summary":"AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion","details":"An XML External Entity (XXE) vulnerability exists in `org.assertj.core.util.xml.XmlStringPrettyFormatter`: the `toXmlDocument(String)` method initializes `DocumentBuilderFactory` with default settings, without disabling DTDs or external entities. This formatter is used by the `isXmlEqualTo(CharSequence)` assertion for `CharSequence` values.\n\nAn application is vulnerable only when it uses untrusted XML input with one of the following methods:\n\n- `isXmlEqualTo(CharSequence)` from `org.assertj.core.api.AbstractCharSequenceAssert`\n- `xmlPrettyFormat(String)` from `org.assertj.core.util.xml.XmlStringPrettyFormatter`\n\n### Impact\n\nIf untrusted XML input is processed by the methods mentioned above (e.g., in test environments handling external fixture files), an attacker could:\n\n- **Read arbitrary local files** via `file://` URIs (e.g., `/etc/passwd`, application configuration files)\n- **Perform Server-Side Request Forgery (SSRF)** via HTTP/HTTPS URIs\n- **Cause Denial of Service** via \"Billion Laughs\" entity expansion attacks\n\n### Mitigation\n\n`isXmlEqualTo(CharSequence)` has been deprecated in favor of [XMLUnit](https://www.xmlunit.org/) in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference:\n\n1. Replace `isXmlEqualTo(CharSequence)` with XMLUnit, or\n2. Upgrade to version 3.27.7, or\n3. Avoid using `isXmlEqualTo(CharSequence)` or `XmlStringPrettyFormatter` with untrusted input.\n\n`XmlStringPrettyFormatter` has historically been considered a utility for `isXmlEqualTo(CharSequence)` rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.\n\n### References\n\n- [CWE-611: Improper Restriction of XML External Entity Reference](https://cwe.mitre.org/data/definitions/611.html)\n- [OWASP XXE Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html)","aliases":["CVE-2026-24400"],"modified":"2026-02-21T07:45:45.133563Z","published":"2026-01-26T21:31:41Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-01-26T21:31:41Z","nvd_published_at":"2026-01-26T23:16:08Z","cwe_ids":["CWE-611"]},"references":[{"type":"WEB","url":"https://github.com/assertj/assertj/security/advisories/GHSA-rqfh-9r24-8c9r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24400"},{"type":"WEB","url":"https://github.com/assertj/assertj/commit/85ca7eb6609bb179c043b85ae7d290523b1ba79a"},{"type":"WEB","url":"https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html"},{"type":"PACKAGE","url":"https://github.com/assertj/assertj"},{"type":"WEB","url":"https://github.com/assertj/assertj/releases/tag/assertj-build-3.27.7"}],"affected":[{"package":{"name":"org.assertj:assertj-core","ecosystem":"Maven","purl":"pkg:maven/org.assertj/assertj-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"3.27.7"}]}],"versions":["1.4.0","1.5.0","1.6.0","1.6.1","1.7.0","1.7.1","2.0.0","2.1.0","2.2.0","2.3.0","2.4.0","2.4.1","2.5.0","2.6.0","2.7.0","2.8.0","2.9.0","2.9.1","3.0.0","3.1.0","3.10.0","3.11.0","3.11.1","3.12.0","3.12.1","3.12.2","3.13.0","3.13.1","3.13.2","3.14.0","3.15.0","3.16.0","3.16.1","3.17.0","3.17.1","3.17.2","3.18.0","3.18.1","3.19.0","3.2.0","3.20.0","3.20.1","3.20.2","3.21.0","3.22.0","3.23.0","3.23.1","3.24.0","3.24.1","3.24.2","3.25.0","3.25.1","3.25.2","3.25.3","3.26.0","3.26.3","3.27.0","3.27.1","3.27.2","3.27.3","3.27.4","3.27.5","3.27.6","3.3.0","3.4.0","3.4.1","3.5.0","3.5.1","3.5.2","3.6.0","3.6.1","3.6.2","3.7.0","3.8.0","3.9.0","3.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-rqfh-9r24-8c9r/GHSA-rqfh-9r24-8c9r.json","last_known_affected_version_range":"\u003c= 3.27.6"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N"}]}