XML External Entity (XXE) vulnerability in apoc.import.graphml
Summary
GHSA-9vx8-f5c4-862x: XML External Entity (XXE) vulnerability in apoc.import.graphml. Affects org.neo4j.procedure:apoc across 2 version ranges.
< 4.4.0.14
>= 5.0.0, < 5.5.0
Fixed in 4.4.0.14 or 5.5.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The apoc.import.graphml procedure is part of the APOC core plugin in the Neo4j graph database. This plugin provides additional functionality to Neo4j, allowing users to import data from GraphML files. The procedure allows importing data from XML files into the graph database. However, a vulnerability known as XML External Entity (XXE) injection has been discovered in this procedure. XXE injection occurs when the XML parser allows external entities to be resolved, which can lead to various security issues.
Vulnerability Detail
The XML External Entity (XXE) vulnerability in the apoc.import.graphml procedure of the APOC core plugin in Neo4j allows for the injection of malicious XML entities. This vulnerability arises due to the insecure configuration of the XML parser used by the procedure. Attackers can exploit this vulnerability to read local files remotely, send unauthorized HTTP requests, and potentially perform denial-of-service attacks. Although the impact of this vulnerability is limited to one-line files with the current level of privileges, it can be escalated if the attacker has write access to the database. Additionally, passing improperly formatted XML can cause the server to crash.
How To Fix
Latest published version: 4.4.0.40 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.4.0.144.4.0.14 -
>= 5.0.0, < 5.5.05.5.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading the library is not feasible, you can implement a workaround by controlling the allowlist of procedures that can be used in your system. By configuring the allowlist, you can restrict the usage of the apoc.import.graphml procedure, effectively mitigating the risk of XXE injection. However, this workaround should be considered temporary, and upgrading to the patched version is strongly recommended for long-term security.
Conclusion
The XML External Entity (XXE) vulnerability in the apoc.import.graphml procedure of the APOC core plugin in Neo4j poses a security risk by allowing for the injection of malicious XML entities. To mitigate this vulnerability, it is crucial to upgrade to the latest released version of the APOC core plugin that includes the necessary patch. If upgrading is not possible, implementing a workaround by controlling the allowlist can provide temporary protection. For further information or assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.neo4j.procedure:apoc →
FAQ
XML External Entity (XXE) injection is a vulnerability that occurs when an XML parser allows the resolution of external entities. This can lead to various security issues, such as reading local files, sending unauthorized HTTP requests, and performing denial-of-service attacks.
The impact of this vulnerability is limited to reading one-line files remotely with the current level of privileges. However, if the attacker has write access to the database, any file can be read. Additionally, passing improperly formatted XML can cause the server to crash.
To fix this vulnerability, it is recommended to upgrade to the latest released version of the APOC core plugin that is compatible with your Neo4j version. The minimum version containing the patch for this vulnerability is 4.4.0.14.
If upgrading the library is not feasible, you can control the allowlist of procedures that can be used in your system. By restricting the usage of the apoc.import.graphml procedure, you can mitigate the risk of XXE injection. However, upgrading to the patched version is strongly recommended for long-term security.
This vulnerability was discovered by Christopher Schneider from State Farm. We want to publicly recognize his contribution.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.neo4j.procedure:apoc.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
