{"action":"Upgrade org.verapdf:validation-model to 1.30.2 (1.30.x) or 1.31.71 (1.31.x) or later.","affected":[{"fixed":"1.30.2","introduced":"1.17.35"},{"fixed":"1.31.71","introduced":"1.31.1"}],"component":"org.verapdf:validation-model","cve_ids":["CVE-2026-54082"],"ecosystem":"Maven","epss":0.00395,"exploited":false,"fixed_versions":["1.30.2","1.31.71"],"ghsa_id":"GHSA-cg9x-g3gm-h5h6","id":"tcs_01M5N8SBPVNJCXKXZ57MYZZQDF","modified_at":"2026-07-29T15:41:43.027627Z","published_at":"2026-07-29T15:14:32Z","references":["https://osv.dev/vulnerability/GHSA-cg9x-g3gm-h5h6","https://github.com/veraPDF/veraPDF-validation/security/advisories/GHSA-cg9x-g3gm-h5h6","https://github.com/veraPDF/veraPDF-validation/pull/730","https://github.com/veraPDF/veraPDF-validation/commit/94caa46c1a594512247fbd46c808edae39469542","https://github.com/veraPDF/veraPDF-validation/commit/cacd9436d0de40b0e58cc7d2dbb06451619e61ec","https://github.com/veraPDF/veraPDF-validation"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-cg9x-g3gm-h5h6","url":"https://osv.dev/vulnerability/GHSA-cg9x-g3gm-h5h6"}],"summary":"veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs"}