Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:maven/org.assertj/assertj-core@3.27.7
Typemaven
Namespaceorg.assertj
Nameassertj-core
Version3.27.7
Qualifiers
Subpath
Is_vulnerablefalse
Next_non_vulnerable_version3.27.7
Latest_non_vulnerable_version3.27.7
Affected_by_vulnerabilities
Fixing_vulnerabilities
0
url VCID-449j-g7eq-bkcy
vulnerability_id VCID-449j-g7eq-bkcy
summary 
AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion
An XML External Entity (XXE) vulnerability exists in `org.assertj.core.util.xml.XmlStringPrettyFormatter`: the `toXmlDocument(String)` method initializes `DocumentBuilderFactory` with default settings, without disabling DTDs or external entities. This formatter is used by the `isXmlEqualTo(CharSequence)` assertion for `CharSequence` values.

An application is vulnerable only when it uses untrusted XML input with one of the following methods:

- `isXmlEqualTo(CharSequence)` from `org.assertj.core.api.AbstractCharSequenceAssert`
- `xmlPrettyFormat(String)` from `org.assertj.core.util.xml.XmlStringPrettyFormatter`
references
0
reference_url https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
reference_id
reference_type
scores
url https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html
1
reference_url https://github.com/assertj/assertj
reference_id
reference_type
scores
url https://github.com/assertj/assertj
2
reference_url https://github.com/assertj/assertj/commit/85ca7eb6609bb179c043b85ae7d290523b1ba79a
reference_id
reference_type
scores
url https://github.com/assertj/assertj/commit/85ca7eb6609bb179c043b85ae7d290523b1ba79a
3
reference_url https://github.com/assertj/assertj/releases/tag/assertj-build-3.27.7
reference_id
reference_type
scores
url https://github.com/assertj/assertj/releases/tag/assertj-build-3.27.7
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2026-24400
reference_id CVE-2026-24400
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2026-24400
5
reference_url https://github.com/advisories/GHSA-rqfh-9r24-8c9r
reference_id GHSA-rqfh-9r24-8c9r
reference_type
scores
url https://github.com/advisories/GHSA-rqfh-9r24-8c9r
6
reference_url https://github.com/assertj/assertj/security/advisories/GHSA-rqfh-9r24-8c9r
reference_id GHSA-rqfh-9r24-8c9r
reference_type
scores
url https://github.com/assertj/assertj/security/advisories/GHSA-rqfh-9r24-8c9r
fixed_packages
0
url pkg:maven/org.assertj/assertj-core@3.27.7
purl pkg:maven/org.assertj/assertj-core@3.27.7
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.assertj/assertj-core@3.27.7
aliases CVE-2026-24400, GHSA-rqfh-9r24-8c9r
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-449j-g7eq-bkcy
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:maven/org.assertj/assertj-core@3.27.7