XML External Entity Injection Vulnerability in CycloneDX Core Module by CycloneDX

CVE-2025-64518

What is CVE-2025-64518?

The CycloneDX core module's XML Validator, utilized in versions 2.1.0 through 11.0.1, contains a security flaw that allows for XML External Entity (XXE) injection. This vulnerability arises from inadequate configuration, enabling malicious actors to exploit the XML parsing process. Although the recent updates address some security concerns, they only partially resolve the issue, as the XML validation remains vulnerable. Users are encouraged to update to the latest version (11.0.1) for enhanced security or to implement a workaround by validating XML documents prior to submission.

References