EUVD-2026-125349

In Eclipse AAS4J before 3.0.1, XmlSchemaValidator.validateSchema and AASXValidator.validateSchema, which calls it validates untrusted XML with a default JAXP Validator that resolves external DTDs and external entities. An attacker who supplies a crafted AAS XML document or AASX package can read...