CVE-2024-28109 json
Potential XSLT injection vulnerability when using policy files
published 2024-03-28 2 y ago modified 2026-06-17 4 mo ago also GHSA-qxqf-2mfx-x8jw , EUVD-2024-1756
- cvss
- 8.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 63%
- public exploits
- 0
- none known
Summary
veraPDF-library is a PDF/A validation library. Executing policy checks using custom schematron files invokes an XSL transformation that could lead to a remote code execution (RCE) vulnerability. This vulnerability is fixed in 1.24.2.
Patch / fix
- maven org.verapdf:core 1.24.2
- maven org.verapdf:core-jakarta 1.24.2
- maven org.verapdf:core-arlington 1.25.127
- maven org.verapdf:verapdf-library-arlington 1.25.127
- maven org.verapdf:verapdf-library 1.24.2
- maven org.verapdf:verapdf-library-jakarta 1.24.2
- maven org.verapdf:library-arlington 1.25.127
- maven org.verapdf:library 1.24.2
- maven org.verapdf:library-jakarta 1.24.2
- veraPDF veraPDF-library 1.24.2
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
1.03% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.verapdf:core | <1.24.2 |
1.24.2 |
| maven | org.verapdf:core-jakarta | <1.24.2 |
1.24.2 |
| maven | org.verapdf:core-arlington | <1.25.127 |
1.25.127 |
| maven | org.verapdf:verapdf-library-arlington | <1.25.127 |
1.25.127 |
| maven | org.verapdf:verapdf-library | <1.24.2 |
1.24.2 |
| maven | org.verapdf:verapdf-library-jakarta | <1.24.2 |
1.24.2 |
| maven | org.verapdf:library-arlington | <1.25.127 |
1.25.127 |
| maven | org.verapdf:library | <1.24.2 |
1.24.2 |
| maven | org.verapdf:library-jakarta | <1.24.2 |
1.24.2 |
Affected products
- veraPDF veraPDF-library
Classification
- Weakness
-
- CWE-91 XML Injection
References
-
github.com
/veraPDF/veraPDF-library/commit/614ffa477a2cf0819e4b0df1ab133610e0da25fb
web
-
github.com
/veraPDF/veraPDF-library/commit/9386ecbe1a1d1fb9e886d19df28851ed07890d9f
web
-
github.com
/veraPDF/veraPDF-library/commit/d5314cbdf4e058e0716f80dbdad2dbd8d96e6bfe
web
-
github.com
/veraPDF/veraPDF-library/security/advisories/GHSA-qxqf-2mfx-x8jw
web
-
github.com
/veraPDF/veraPDF-library/issues/1415
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-28109
advisory
-
github.com
/veraPDF/veraPDF-library
package
Sources
- CVE List CVE-2024-28109
- GitHub Advisory GHSA-qxqf-2mfx-x8jw
- NVD CVE-2024-28109
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.