{"action":"Upgrade org.assertj:assertj-core to 3.27.7 or later.","affected":[{"fixed":"3.27.7","introduced":"1.4.0"}],"component":"org.assertj:assertj-core","cve_ids":["CVE-2026-24400"],"ecosystem":"Maven","epss":0.00568,"exploited":false,"fixed_versions":["3.27.7"],"ghsa_id":"GHSA-rqfh-9r24-8c9r","id":"tcs_01M5N9CAVW332BCAZQHMEJY6GT","modified_at":"2026-02-03T03:04:53.356771Z","published_at":"2026-01-26T21:31:41Z","references":["https://osv.dev/vulnerability/GHSA-rqfh-9r24-8c9r","https://github.com/assertj/assertj/security/advisories/GHSA-rqfh-9r24-8c9r","https://nvd.nist.gov/vuln/detail/CVE-2026-24400","https://github.com/assertj/assertj/commit/85ca7eb6609bb179c043b85ae7d290523b1ba79a","https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html","https://github.com/assertj/assertj","https://github.com/assertj/assertj/releases/tag/assertj-build-3.27.7"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-rqfh-9r24-8c9r","url":"https://osv.dev/vulnerability/GHSA-rqfh-9r24-8c9r"},{"source":"nvd","source_id":"CVE-2026-24400","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24400"}],"summary":"AssertJ has XML External Entity (XXE) vulnerability when parsing untrusted XML via isXmlEqualTo assertion"}