CVE-2026-24400 is a low severity vulnerability with a CVSS score of 0.0. No known exploits currently, and patches are available.
Very low probability of exploitation
EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.
An XML External Entity (XXE) vulnerability exists in org.assertj.core.util.xml.XmlStringPrettyFormatter: the toXmlDocument(String) method initializes DocumentBuilderFactory with default settings, without disabling DTDs or external entities. This formatter is used by the isXmlEqualTo(CharSequence) assertion for CharSequence values.
An application is vulnerable only when it uses untrusted XML input with one of the following methods:
isXmlEqualTo(CharSequence) from org.assertj.core.api.AbstractCharSequenceAssertxmlPrettyFormat(String) from org.assertj.core.util.xml.XmlStringPrettyFormatterIf untrusted XML input is processed by the methods mentioned above (e.g., in test environments handling external fixture files), an attacker could:
file:// URIs (e.g., /etc/passwd, application configuration files)isXmlEqualTo(CharSequence) has been deprecated in favor of XMLUnit in version 3.18.0 and will be removed in version 4.0. Users of affected versions should, in order of preference:
isXmlEqualTo(CharSequence) with XMLUnit, orisXmlEqualTo(CharSequence) or XmlStringPrettyFormatter with untrusted input.XmlStringPrettyFormatter has historically been considered a utility for isXmlEqualTo(CharSequence) rather than a feature for AssertJ users, so it is deprecated in version 3.27.7 and removed in version 4.0, with no replacement.
Please cite this page when referencing data from Strobes VI. Proper attribution helps support our vulnerability intelligence research.