XML External Entity (XXE) Vulnerability in JGit Package
Summary
CVE-2025-4949: In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git p... Affects jgit versions 4.11.9-1 – 6.7.0-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Eclipse JGit is a lightweight, pure Java implementation of the Git version control system. It allows users to manage Git repositories programmatically and provides functionalities such as cloning, fetching, and pushing changes. JGit is widely used in various applications that require Git integration. However, versions 7.2.0.202503040940-r and older are susceptible to XML External Entity (XXE) attacks, which can compromise the security of applications utilizing this package.
Vulnerability Detail
The vulnerability arises from the ManifestParser class and the AmazonS3 class within JGit, which are responsible for parsing XML files. When these classes process XML input, they do not adequately restrict the parsing of external entities. This oversight can lead to various security issues, including information disclosure, denial of service, and potential exploitation by attackers to manipulate the XML data being processed.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the parsing of external entities in XML processing. This can be done by configuring the XML parser settings in your application to prevent the loading of external DTDs and entities. For example, if using Java, you can set the following properties:
System.setProperty('javax.xml.XMLConstants/property/accessExternalDTD', 'none');
System.setProperty('javax.xml.XMLConstants/property/accessExternalStylesheet', 'none');
Conclusion
The XXE vulnerability in JGit poses significant risks to applications utilizing this package. It is crucial for developers and system administrators to update to a secure version of JGit and implement recommended workarounds to safeguard their applications from potential attacks.
See every vulnerability recorded for jgit →
FAQ
An XXE attack occurs when an XML parser processes external entities, allowing an attacker to read files on the server, perform denial of service attacks, or execute other malicious actions.
You can use tools like Vulert, which monitors open-source vulnerabilities in your software by analyzing your manifest file. Visit Vulert Scanner to check if your application is affected.
The consequences can include unauthorized access to sensitive information, service disruptions, and increased risk of further attacks on your application.
Yes, updating JGit to a version newer than 7.2.0.202503040940-r will resolve the vulnerability.
If immediate updates are not possible, implement the suggested workarounds to disable external entity parsing in your XML processing.
Related vulnerabilities
Recent vulnerabilities recorded for jgit.
