CVE-2024-31573

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2024
Source publication: Oct 17, 2025
Source updated: Oct 17, 2025
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

XMLUnit for Java

Vendor: XMLUnit
Product: XMLUnit for Java
Platforms: Unknown
Default status: unknown

XMLUnit for Java · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
2.0.0	`affected`	semver	2.10.0	Unavailable	None listed