Eclipse JGit XML External Entity (XXE) Vulnerability

🗓️ 21 May 2025 21:31:37Reported by GitHub Advisory DatabaseType

Eclipse JGit versions 7.2.0 and older have XML External Entity vulnerability leading to information disclosure.

Reporter	Title	Published	Views	Family All 105
IBM Security Bulletins	Security Bulletin: IBM Application Modernization Accelerator is affected by multiple vulnerabilities found in Java and Node.js (CVE-2025-48924, CVE-2025-4949)	18 Aug 202510:33	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of Eclipse JGit, IBM webMethods Integration is affected by denial of service, and other security issues.	11 Nov 202513:30	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions.	12 Aug 202509:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Transformation Advisor is affected by multiple vulnerabilities found in Java and Node.js (CVE-2025-48924, CVE-2025-4949)	18 Aug 202510:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Toolkit and IBM Integration Bus for z/OS Toolkit are vulnerable to Improper Restriction of XML External Entity Reference due to Eclipse JGit (CVE-2025-4949)	29 Sep 202515:38	–	ibm
IBM Security Bulletins	Security Bulletin:DevOps Test Embedded for Eclipse IDE is vulnerable to XXE injection & RCE due to use of JGit and EGit ( CVE-2023-4759 and CVE-2025-4949)	19 May 202607:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability has addressed Multiple Vulnerabilities within Instana Agent container image	9 Oct 202511:04	–	ibm
Chainguard	CVE-2025-4949 vulnerabilities	23 May 202513:16	–	cgr
Circl	CVE-2025-4949	23 May 202507:44	–	circl
CNNVD	Eclipse JGit 代码问题漏洞	21 May 202500:00	–	cnnvd

Vulners

Node

org.eclipse.jgit org.eclipse.jgitRange6.0.0.202110060947-m1–6.0.0.202111291000-rmaven

org.eclipse.jgit org.eclipse.jgitRange<5.13.4.202507202350-rmaven

org.eclipse.jgit org.eclipse.jgitRange6.1.0.202203080745-r–6.10.1.202505221210-rmaven

org.eclipse.jgit org.eclipse.jgitRange7.0.0.202409031743-r–7.0.1.202505221510-rmaven

org.eclipse.jgit org.eclipse.jgitRange7.1.0.202411261347-r–7.1.1.202505221757-rmaven

org.eclipse.jgit org.eclipse.jgitRange7.2.0.202503040940-r–7.2.1.202505142326-rmaven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-4949
gitlab	www.gitlab.eclipse.org/security/cve-assignement/-/issues/64
gitlab	www.gitlab.eclipse.org/security/vulnerability-reports/-/issues/281
projects	www.projects.eclipse.org/projects/technology.jgit/releases/7.2.1
projects	www.projects.eclipse.org/projects/technology.jgit/releases/6.10.1
projects	www.projects.eclipse.org/projects/technology.jgit/releases/7.0.1
projects	www.projects.eclipse.org/projects/technology.jgit/releases/7.1.1
projects	www.projects.eclipse.org/projects/technology.jgit/releases/5.13.4
projects	www.projects.eclipse.org/projects/technology.jgit/releases/5.13.5
github	www.github.com/advisories/GHSA-vrpq-qp53-qv56

13 Jan 2026 22:47Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.15.3

CVSS 46.8

EPSS0.00197

SSVC

CWE-611