GHSA-rqfh-9r24-8c9r

Suggest an improvement
Source
https://github.com/advisories/GHSA-rqfh-9r24-8c9r
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-rqfh-9r24-8c9r/GHSA-rqfh-9r24-8c9r.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-rqfh-9r24-8c9r
Aliases
Downstream
CGA (6)
Published
2026-01-26T21:31:41Z
Modified
2026-02-21T07:45:45Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:H/SI:N/SA:N CVSS Calculator
Summary
AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
Details

An XML External Entity (XXE) vulnerability exists in org.assertj.core.util.xml.XmlStringPrettyFormatter: the toXmlDocument(String) method initializes DocumentBuilderFactory with default settings, without disabling DTDs or external entities. This formatter is used by the isXmlEqualTo(CharSequence) assertion for CharSequence values.

An application is vulnerable only when it uses untrusted XML input with one of the following methods:

  • isXmlEqualTo(CharSequence) from org.assertj.core.api.AbstractCharSequenceAssert
  • xmlPrettyFormat(String) from org.assertj.core.util.xml.XmlStringPrettyFormatter

Impact

If untrusted XML input is processed by the methods mentioned above (e.g., in test environments handling external fixture files), an attacker could:

  • Read arbitrary local files via file:// URIs (e.g., /etc/passwd, application configuration files)
  • Perform Server-Side Request Forgery (SSRF) via HTTP/HTTPS URIs
  • Cause Denial of Service via "Billion Laughs" entity expansion attacks

Mitigation

isXmlEqualTo(CharSequence) has been deprecated in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference:

  1. Replace isXmlEqualTo(CharSequence) with XMLUnit, or
  2. Upgrade to version 3.27.7, or
  3. Avoid using isXmlEqualTo(CharSequence) or XmlStringPrettyFormatter with untrusted input.

XmlStringPrettyFormatter has historically been considered a utility for isXmlEqualTo(CharSequence) rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.

References

Database specific 
{
    "cwe_ids": [
        "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-26T21:31:41Z",
    "nvd_published_at": "2026-01-26T23:16:08Z",
    "severity": "HIGH"
}
References

Affected packages

Maven / org.assertj:assertj-core

Package

Name
org.assertj:assertj-core
View open source insights on deps.dev
Purl
pkg:maven/org.assertj/assertj-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
1.4.0
Fixed
3.27.7

Affected versions

1.*
1.4.0
1.5.0
1.6.0
1.6.1
1.7.0
1.7.1
2.*
2.0.0
2.1.0
2.2.0
2.3.0
2.4.0
2.4.1
2.5.0
2.6.0
2.7.0
2.8.0
2.9.0
2.9.1
3.*
3.0.0
3.1.0
3.2.0
3.3.0
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.6.0
3.6.1
3.6.2
3.7.0
3.8.0
3.9.0
3.9.1
3.10.0
3.11.0
3.11.1
3.12.0
3.12.1
3.12.2
3.13.0
3.13.1
3.13.2
3.14.0
3.15.0
3.16.0
3.16.1
3.17.0
3.17.1
3.17.2
3.18.0
3.18.1
3.19.0
3.20.0
3.20.1
3.20.2
3.21.0
3.22.0
3.23.0
3.23.1
3.24.0
3.24.1
3.24.2
3.25.0
3.25.1
3.25.2
3.25.3
3.26.0
3.26.3
3.27.0
3.27.1
3.27.2
3.27.3
3.27.4
3.27.5
3.27.6

Database specific

last_known_affected_version_range 
"<= 3.27.6"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-rqfh-9r24-8c9r/GHSA-rqfh-9r24-8c9r.json"