{"action":"Upgrade org.verapdf:library-jakarta to 1.24.2 or later.","affected":[{"fixed":"1.24.2","introduced":"0"}],"component":"org.verapdf:library-jakarta","cve_ids":["CVE-2024-28109"],"ecosystem":"Maven","epss":0.01033,"exploited":false,"fixed_versions":["1.24.2"],"ghsa_id":"GHSA-qxqf-2mfx-x8jw","id":"tcs_01M5N9AK3XCS8XE6J6AVWCQJKX","modified_at":"2026-05-14T21:03:50.227541Z","published_at":"2024-05-20T14:57:07Z","references":["https://osv.dev/vulnerability/GHSA-qxqf-2mfx-x8jw","https://github.com/veraPDF/veraPDF-library/security/advisories/GHSA-qxqf-2mfx-x8jw","https://nvd.nist.gov/vuln/detail/CVE-2024-28109","https://github.com/veraPDF/veraPDF-library/issues/1415","https://github.com/veraPDF/veraPDF-library/commit/614ffa477a2cf0819e4b0df1ab133610e0da25fb","https://github.com/veraPDF/veraPDF-library/commit/9386ecbe1a1d1fb9e886d19df28851ed07890d9f","https://github.com/veraPDF/veraPDF-library/commit/d5314cbdf4e058e0716f80dbdad2dbd8d96e6bfe","https://github.com/veraPDF/veraPDF-library"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-qxqf-2mfx-x8jw#Maven/org.verapdf:library-jakarta","url":"https://osv.dev/vulnerability/GHSA-qxqf-2mfx-x8jw"}],"summary":"veraPDF has potential XSLT injection vulnerability when using policy files"}