漏洞关键信息 漏洞名称 BOM validation is vulnerable to XML External Entity injection 严重性 等级: High CVSS v3 base metrics - Attack vector: Network - Attack complexity: Low - Privileges required: None - User interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: None - Availability: None 影响 The XML Validator used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. The fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 has been incomplete in that it only fixed parsing of XML BOMs, but not validation. 影响版本 Affected versions: <11.0.1 Patched versions: 11.0.1 解决方案 The vulnerability has been fixed in cyclonedx-core-java version 11.0.1. 临时解决办法 If feasible, applications can reject XML documents before handing them to cyclonedx-core-java for validation. This may be an option if incoming CycloneDX BOMs are known to be in JSON format. 参考资料 The issue was introduced via 162aa59 The issue was fixed via #737 https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#schemafactory CVE ID CVE-2025-64518 弱点 CWE-611 贡献者 nscc2ro: Remediation developer BrightKn1ght: Reporter