{"action":"Upgrade org.eclipse.jgit:org.eclipse.jgit to the fixed version for your line (see fixed_versions).","affected":[{"fixed":"7.2.1.202505142326-r","introduced":"7.2.0.202503040940-r"},{"fixed":"7.1.1.202505221757-r","introduced":"7.1.0.202411261347-r"},{"fixed":"7.0.1.202505221510-r","introduced":"7.0.0.202409031743-r"},{"fixed":"6.10.1.202505221210-r","introduced":"6.1.0.202203080745-r"},{"fixed":"6.0.0.202111291000-r","introduced":"6.0.0.202110060947-m1"},{"fixed":"5.13.4.202507202350-r","introduced":"0"}],"component":"org.eclipse.jgit:org.eclipse.jgit","cve_ids":["CVE-2025-4949"],"ecosystem":"Maven","epss":0.00844,"exploited":false,"fixed_versions":["7.2.1.202505142326-r","7.1.1.202505221757-r","7.0.1.202505221510-r","6.10.1.202505221210-r","6.0.0.202111291000-r","5.13.4.202507202350-r"],"ghsa_id":"GHSA-vrpq-qp53-qv56","id":"tcs_01M5N9ERB02X0VA22V1WCBYBA7","modified_at":"2026-09-10T03:50:24.825531340Z","published_at":"2025-05-21T21:31:37Z","references":["https://osv.dev/vulnerability/GHSA-vrpq-qp53-qv56","https://nvd.nist.gov/vuln/detail/CVE-2025-4949","https://github.com/eclipse-jgit/jgit","https://gitlab.eclipse.org/security/cve-assignement/-/issues/64","https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/281","https://projects.eclipse.org/projects/technology.jgit/releases/5.13.4","https://projects.eclipse.org/projects/technology.jgit/releases/5.13.5","https://projects.eclipse.org/projects/technology.jgit/releases/6.10.1","https://projects.eclipse.org/projects/technology.jgit/releases/7.0.1","https://projects.eclipse.org/projects/technology.jgit/releases/7.1.1","https://projects.eclipse.org/projects/technology.jgit/releases/7.2.1"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-vrpq-qp53-qv56","url":"https://osv.dev/vulnerability/GHSA-vrpq-qp53-qv56"},{"source":"nvd","source_id":"CVE-2025-4949","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-4949"}],"summary":"Eclipse JGit XML External Entity (XXE) Vulnerability"}