{"action":"Upgrade edu.stanford.nlp:stanford-corenlp to 4.4.0 or later.","affected":[{"fixed":"4.4.0","introduced":"0"}],"component":"edu.stanford.nlp:stanford-corenlp","cve_ids":["CVE-2022-0239"],"ecosystem":"Maven","epss":0.01217,"exploited":false,"fixed_versions":["4.4.0"],"ghsa_id":"GHSA-75vw-3m5v-fprh","id":"tcs_01M5N8HHS4VSNPXFF4ZC913PP4","modified_at":"2026-04-15T00:05:01.487716Z","published_at":"2022-01-21T23:43:11Z","references":["https://osv.dev/vulnerability/GHSA-75vw-3m5v-fprh","https://nvd.nist.gov/vuln/detail/CVE-2022-0239","https://github.com/stanfordnlp/CoreNLP/pull/1242","https://github.com/stanfordnlp/CoreNLP/commit/f44e693882812b144e09d39850177ff0a1f8d16f","https://github.com/stanfordnlp/corenlp/commit/1940ffb938dc4f3f5bc5f2a2fd8b35aabbbae3dd","https://github.com/stanfordnlp/corenlp","https://huntr.dev/bounties/a717aec2-5646-4a5f-ade0-dadc25736ae3","https://security.snyk.io/vuln/SNYK-JAVA-EDUSTANFORDNLP-2342121"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-75vw-3m5v-fprh","url":"https://osv.dev/vulnerability/GHSA-75vw-3m5v-fprh"}],"summary":"corenlp is vulnerable to Improper Restriction of XML External Entity Reference"}