{ "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-5vvx-3h34-f3gj/GHSA-5vvx-3h34-f3gj.json" }, "package": { "ecosystem": "Maven", "name": "net.sf.mpxj:mpxj", "purl": "pkg:maven/net.sf.mpxj/mpxj" }, "ranges": [ { "events": [ { "introduced": "5.5.5" }, { "fixed": "16.4.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "10.0.0", "10.0.1", "10.0.3", "10.0.4", "10.0.5", "10.1.0", "10.10.0", "10.11.0", "10.12.0", "10.13.0", "10.14.0", "10.14.1", "10.15.0", "10.16.0", "10.16.1", "10.16.2", "10.2.0", "10.3.0", "10.4.0", "10.5.0", "10.6.0", "10.6.1", "10.6.2", "10.7.0", "10.8.0", "10.9.0", "10.9.1", "11.0.0", "11.1.0", "11.2.0", "11.3.0", "11.3.1", "11.3.2", "11.4.0", "11.5.0", "11.5.1", "11.5.2", "11.5.3", "11.5.4", "12.0.0", "12.0.1", "12.0.2", "12.1.0", "12.1.1", "12.1.2", "12.1.3", "12.10.0", "12.10.1", "12.10.2", "12.10.3", "12.2.0", "12.3.0", "12.4.0", "12.5.0", "12.6.0", "12.7.0", "12.8.0", "12.8.1", "12.9.0", "12.9.1", "12.9.2", "12.9.3", "13.0.0", "13.0.1", "13.0.2", "13.1.0", "13.10.0", "13.11.0", "13.12.0", "13.2.0", "13.2.1", "13.3.0", "13.3.1", "13.4.0", "13.4.1", "13.4.2", "13.5.0", "13.5.1", "13.6.0", "13.7.0", "13.8.0", "13.9.0", "14.0.0", "14.1.0", "14.2.0", "14.3.0", "14.3.1", "14.3.2", "14.3.3", "14.3.4", "14.3.5", "14.4.0", "14.5.0", "14.5.1", "14.5.2", "15.0.0", "15.1.0", "15.2.0", "15.3.0", "15.3.1", "16.0.0", "16.1.0", "16.2.0", "16.3.0", "16.4.0", "5.10.0", "5.11.0", "5.12.0", "5.13.0", "5.14.0", "5.5.5", "5.5.6", "5.5.7", "5.5.8", "5.5.9", "5.6.0", "5.6.1", "5.6.2", "5.6.3", "5.6.4", "5.6.5", "5.7.0", "5.7.1", "5.8.0", "5.9.0", "6.0.0", "6.1.0", "6.1.2", "6.2.0", "7.0.0", "7.0.1", "7.0.2", "7.0.3", "7.1.0", "7.2.0", "7.2.1", "7.3.0", "7.4.0", "7.4.1", "7.4.2", "7.4.3", "7.4.4", "7.5.0", "7.6.0", "7.6.1", "7.6.2", "7.6.3", "7.7.0", "7.7.1", "7.8.0", "7.8.1", "7.8.2", "7.8.3", "7.8.4", "7.9.0", "7.9.1", "7.9.2", "7.9.3", "7.9.4", "7.9.5", "7.9.7", "7.9.8", "8.0.0", "8.0.2", "8.0.3", "8.0.4", "8.0.5", "8.0.6", "8.0.7", "8.0.8", "8.1.0", "8.1.1", "8.1.2", "8.1.3", "8.1.4", "8.2.0", "8.3.0", "8.3.1", "8.3.2", "8.3.3", "8.3.4", "8.3.5", "8.4.0", "8.5.0", "8.5.1", "9.0.0", "9.1.0", "9.2.0", "9.2.1", "9.2.2", "9.2.3", "9.2.4", "9.2.5", "9.2.6", "9.3.0", "9.3.1", "9.4.0", "9.5.0", "9.5.1", "9.5.2", "9.6.0", "9.7.0", "9.8.0", "9.8.1", "9.8.2", "9.8.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-5vvx-3h34-f3gj/GHSA-5vvx-3h34-f3gj.json" }, "package": { "ecosystem": "RubyGems", "name": "mpxj", "purl": "pkg:gem/mpxj" }, "ranges": [ { "events": [ { "introduced": "5.5.5" }, { "fixed": "16.4.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "10.0.0", "10.0.1", "10.0.2", "10.0.3", "10.0.4", "10.0.5", "10.1.0", "10.10.0", "10.11.0", "10.12.0", "10.13.0", "10.14.0", "10.14.1", "10.15.0", "10.16.0", "10.16.1", "10.16.2", "10.2.0", "10.3.0", "10.4.0", "10.5.0", "10.6.0", "10.6.1", "10.6.2", "10.7.0", "10.8.0", "10.9.0", "10.9.1", "11.0.0", "11.1.0", "11.2.0", "11.3.0", "11.3.1", "11.3.2", "11.4.0", "11.5.0", "11.5.1", "11.5.2", "11.5.3", "11.5.4", "12.0.0", "12.0.1", "12.0.2", "12.1.0", "12.1.1", "12.1.2", "12.1.3", "12.10.0", "12.10.1", "12.10.2", "12.10.3", "12.2.0", "12.3.0", "12.4.0", "12.5.0", "12.6.0", "12.7.0", "12.8.0", "12.8.1", "12.9.0", "12.9.1", "12.9.2", "12.9.3", "13.0.0", "13.0.1", "13.0.2", "13.1.0", "13.10.0", "13.11.0", "13.12.0", "13.2.0", "13.2.1", "13.3.0", "13.3.1", "13.4.0", "13.4.1", "13.5.0", "13.5.1", "13.6.0", "13.7.0", "13.8.0", "13.9.0", "14.0.0", "14.1.0", "14.2.0", "14.3.0", "14.3.1", "14.3.2", "14.3.3", "14.3.4", "14.3.5", "14.4.0", "14.5.0", "14.5.1", "14.5.2", "15.0.0", "15.1.0", "15.2.0", "15.3.0", "15.3.1", "16.0.0", "16.1.0", "16.2.0", "16.3.0", "16.4.0", "5.10.0", "5.11.0", "5.12.0", "5.13.0", "5.14.0", "5.5.5", "5.5.6", "5.5.7", "5.5.8", "5.5.9", "5.6.0", "5.6.1", "5.6.2", "5.6.3", "5.6.4", "5.6.5", "5.7.0", "5.7.1", "5.8.0", "5.9.0", "6.0.0", "6.1.0", "6.1.1", "6.1.2", "6.2.0", "6.2.1", "7.0.0", "7.0.1", "7.0.2", "7.0.3", "7.1.0", "7.2.0", "7.2.1", "7.3.0", "7.4.0", "7.4.1", "7.4.2", "7.4.3", "7.4.4", "7.5.0", "7.6.0", "7.6.1", "7.6.2", "7.6.3", "7.7.0", "7.7.1", "7.8.0", "7.8.1", "7.8.2", "7.8.3", "7.8.4", "7.9.0", "7.9.1", "7.9.2", "7.9.3", "7.9.4", "7.9.5", "7.9.6", "7.9.7", "7.9.8", "8.0.0", "8.0.2", "8.0.3", "8.0.4", "8.0.5", "8.0.6", "8.0.7", "8.0.8", "8.1.0", "8.1.1", "8.1.2", "8.1.3", "8.1.4", "8.2.0", "8.3.0", "8.3.1", "8.3.2", "8.3.3", "8.3.4", "8.3.5", "8.4.0", "8.5.0", "8.5.1", "9.0.0", "9.1.0", "9.2.0", "9.2.1", "9.2.2", "9.2.3", "9.2.4", "9.2.5", "9.2.6", "9.3.0", "9.3.1", "9.4.0", "9.5.0", "9.5.1", "9.5.2", "9.6.0", "9.7.0", "9.8.0", "9.8.1", "9.8.2", "9.8.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-5vvx-3h34-f3gj/GHSA-5vvx-3h34-f3gj.json" }, "package": { "ecosystem": "NuGet", "name": "MPXJ.Net", "purl": "pkg:nuget/MPXJ.Net" }, "ranges": [ { "events": [ { "introduced": "5.5.5" }, { "fixed": "16.4.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "13.0.0", "13.0.1", "13.0.2", "13.1.0", "13.10.0", "13.11.0", "13.12.0", "13.2.0", "13.2.1", "13.2.2", "13.3.0", "13.3.1", "13.4.0", "13.4.1", "13.4.2", "13.5.0", "13.5.1", "13.6.0", "13.8.0", "13.9.0", "14.0.0", "14.1.0", "14.2.0", "14.3.0", "14.3.1", "14.3.2", "14.3.3", "14.3.4", "14.3.5", "14.4.0", "14.5.0", "14.5.1", "14.5.2", "15.0.0", "15.1.0", "15.2.0", "15.3.0", "15.3.1", "16.0.0", "16.1.0", "16.2.0", "16.3.0", "16.4.0" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-5vvx-3h34-f3gj/GHSA-5vvx-3h34-f3gj.json" }, "package": { "ecosystem": "NuGet", "name": "net.sf.mpxj", "purl": "pkg:nuget/net.sf.mpxj" }, "ranges": [ { "events": [ { "introduced": "5.5.5" }, { "fixed": "16.4.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "10.0.0", "10.0.1", "10.0.2", "10.0.3", "10.0.4", "10.0.5", "10.1.0", "10.10.0", "10.11.0", "10.12.0", "10.13.0", "10.14.0", "10.14.1", "10.15.0", "10.16.0", "10.16.1", "10.16.2", "10.2.0", "10.3.0", "10.4.0", "10.5.0", "10.6.0", "10.6.1", "10.6.2", "10.7.0", "10.8.0", "10.9.0", "10.9.1", "11.0.0", "11.1.0", "11.2.0", "11.3.0", "11.3.1", "11.3.2", "11.4.0", "11.5.0", "11.5.1", "11.5.2", "11.5.3", "11.5.4", "12.0.0", "12.0.1", "12.0.2", "12.1.0", "12.1.1", "12.1.2", "12.1.3", "12.10.0", "12.10.1", "12.10.2", "12.10.3", "12.2.0", "12.3.0", "12.4.0", "12.5.0", "12.6.0", "12.7.0", "12.8.0", "12.8.1", "12.9.0", "12.9.1", "12.9.2", "12.9.3", "13.0.0", "13.0.1", "13.0.2", "13.1.0", "13.10.0", "13.11.0", "13.12.0", "13.2.0", "13.2.1", "13.3.0", "13.3.1", "13.4.0", "13.4.1", "13.4.2", "13.5.0", "13.5.1", "13.6.0", "13.7.0", "13.8.0", "13.9.0", "5.10.0", "5.11.0", "5.12.0", "5.13.0", "5.14.0", "5.5.5", "5.5.6", "5.5.7", "5.5.8", "5.5.9", "5.6.0", "5.6.1", "5.6.2", "5.6.3", "5.6.4", "5.6.5", "5.7.0", "5.7.1", "5.8.0", "5.9.0", "6.0.0", "6.1.0", "6.1.2", "6.2.0", "6.2.1", "7.0.0", "7.0.1", "7.0.2", "7.0.3", "7.1.0", "7.2.0", "7.2.1", "7.3.0", "7.4.0", "7.4.1", "7.4.2", "7.4.3", "7.4.4", "7.5.0", "7.6.0", "7.6.1", "7.6.2", "7.6.3", "7.7.0", "7.7.1", "7.8.0", "7.8.1", "7.8.2", "7.8.3", "7.8.4", "7.9.0", "7.9.1", "7.9.2", "7.9.3", "7.9.4", "7.9.5", "7.9.7", "7.9.8", "8.0.0", "8.0.1", "8.0.2", "8.0.3", "8.0.4", "8.0.5", "8.0.6", "8.0.8", "8.1.0", "8.1.1", "8.1.2", "8.1.3", "8.1.4", "8.2.0", "8.3.0", "8.3.1", "8.3.2", "8.3.3", "8.3.4", "8.3.5", "8.4.0", "8.5.0", "8.5.1", "9.0.0", "9.1.0", "9.2.0", "9.2.1", "9.2.2", "9.2.3", "9.2.4", "9.2.5", "9.2.6", "9.3.0", "9.3.1", "9.4.0", "9.5.0", "9.5.1", "9.5.2", "9.6.0", "9.7.0", "9.8.0", "9.8.1", "9.8.2", "9.8.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-5vvx-3h34-f3gj/GHSA-5vvx-3h34-f3gj.json" }, "package": { "ecosystem": "NuGet", "name": "net.sf.mpxj-for-csharp", "purl": "pkg:nuget/net.sf.mpxj-for-csharp" }, "ranges": [ { "events": [ { "introduced": "5.5.5" }, { "fixed": "16.4.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "10.0.0", "10.0.1", "10.0.2", "10.0.3", "10.0.4", "10.0.5", "10.1.0", "10.10.0", "10.11.0", "10.12.0", "10.13.0", "10.14.0", "10.14.1", "10.15.0", "10.16.0", "10.16.1", "10.16.2", "10.2.0", "10.3.0", "10.4.0", "10.5.0", "10.6.0", "10.6.1", "10.6.2", "10.7.0", "10.8.0", "10.9.0", "10.9.1", "11.0.0", "11.1.0", "11.2.0", "11.3.0", "11.3.1", "11.3.2", "11.4.0", "11.5.0", "11.5.1", "11.5.2", "11.5.3", "11.5.4", "12.0.0", "12.0.1", "12.0.2", "12.1.0", "12.1.1", "12.1.2", "12.1.3", "12.10.0", "12.10.1", "12.10.2", "12.10.3", "12.2.0", "12.3.0", "12.4.0", "12.5.0", "12.6.0", "12.7.0", "12.8.0", "12.8.1", "12.9.0", "12.9.1", "12.9.2", "12.9.3", "13.0.0", "13.0.1", "13.0.2", "13.1.0", "13.10.0", "13.11.0", "13.12.0", "13.2.0", "13.2.1", "13.3.0", "13.3.1", "13.4.0", "13.4.1", "13.4.2", "13.5.0", "13.5.1", "13.6.0", "13.7.0", "13.8.0", "13.9.0", "5.10.0", "5.11.0", "5.12.0", "5.13.0", "5.14.0", "5.5.5", "5.5.6", "5.5.7", "5.5.8", "5.5.9", "5.6.0", "5.6.1", "5.6.2", "5.6.3", "5.6.4", "5.6.5", "5.7.0", "5.7.1", "5.8.0", "5.9.0", "6.0.0", "6.1.0", "6.1.2", "6.2.0", "6.2.1", "7.0.0", "7.0.1", "7.0.2", "7.0.3", "7.1.0", "7.2.0", "7.2.1", "7.3.0", "7.4.0", "7.4.1", "7.4.2", "7.4.3", "7.4.4", "7.5.0", "7.6.0", "7.6.1", "7.6.2", "7.6.3", "7.7.0", "7.7.1", "7.8.0", "7.8.1", "7.8.2", "7.8.3", "7.8.4", "7.9.0", "7.9.1", "7.9.2", "7.9.3", "7.9.4", "7.9.5", "7.9.7", "7.9.8", "8.0.0", "8.0.1", "8.0.2", "8.0.3", "8.0.4", "8.0.5", "8.0.6", "8.0.8", "8.1.0", "8.1.1", "8.1.2", "8.1.3", "8.1.4", "8.2.0", "8.3.0", "8.3.1", "8.3.2", "8.3.3", "8.3.4", "8.3.5", "8.4.0", "8.5.0", "8.5.1", "9.0.0", "9.1.0", "9.2.0", "9.2.1", "9.2.2", "9.2.3", "9.2.4", "9.2.5", "9.2.6", "9.3.0", "9.3.1", "9.4.0", "9.5.0", "9.5.1", "9.5.2", "9.6.0", "9.7.0", "9.8.0", "9.8.1", "9.8.2", "9.8.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-5vvx-3h34-f3gj/GHSA-5vvx-3h34-f3gj.json" }, "package": { "ecosystem": "NuGet", "name": "net.sf.mpxj-for-vb", "purl": "pkg:nuget/net.sf.mpxj-for-vb" }, "ranges": [ { "events": [ { "introduced": "5.5.5" }, { "fixed": "16.4.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "10.0.0", "10.0.1", "10.0.2", "10.0.3", "10.0.4", "10.0.5", "10.1.0", "10.10.0", "10.11.0", "10.12.0", "10.13.0", "10.14.0", "10.14.1", "10.15.0", "10.16.0", "10.16.1", "10.16.2", "10.2.0", "10.3.0", "10.4.0", "10.5.0", "10.6.0", "10.6.1", "10.6.2", "10.7.0", "10.8.0", "10.9.0", "10.9.1", "11.0.0", "11.1.0", "11.2.0", "11.3.0", "11.3.1", "11.3.2", "11.4.0", "11.5.0", "11.5.1", "11.5.2", "11.5.3", "11.5.4", "12.0.0", "12.0.1", "12.0.2", "12.1.0", "12.1.1", "12.1.2", "12.1.3", "12.10.0", "12.10.1", "12.10.2", "12.10.3", "12.2.0", "12.3.0", "12.4.0", "12.5.0", "12.6.0", "12.7.0", "12.8.0", "12.8.1", "12.9.0", "12.9.1", "12.9.2", "12.9.3", "13.0.0", "13.0.1", "13.0.2", "13.1.0", "13.10.0", "13.11.0", "13.12.0", "13.2.0", "13.2.1", "13.3.0", "13.3.1", "13.4.0", "13.4.1", "13.4.2", "13.5.0", "13.5.1", "13.6.0", "13.7.0", "13.8.0", "13.9.0", "5.10.0", "5.11.0", "5.12.0", "5.13.0", "5.14.0", "5.5.5", "5.5.6", "5.5.7", "5.5.8", "5.5.9", "5.6.0", "5.6.1", "5.6.2", "5.6.3", "5.6.4", "5.6.5", "5.7.0", "5.7.1", "5.8.0", "5.9.0", "6.0.0", "6.1.0", "6.1.2", "6.2.0", "6.2.1", "7.0.0", "7.0.1", "7.0.2", "7.0.3", "7.1.0", "7.2.0", "7.2.1", "7.3.0", "7.4.0", "7.4.1", "7.4.2", "7.4.3", "7.4.4", "7.5.0", "7.6.0", "7.6.1", "7.6.2", "7.6.3", "7.7.0", "7.7.1", "7.8.0", "7.8.1", "7.8.2", "7.8.3", "7.8.4", "7.9.0", "7.9.1", "7.9.2", "7.9.3", "7.9.4", "7.9.5", "7.9.7", "7.9.8", "8.0.0", "8.0.1", "8.0.2", "8.0.3", "8.0.4", "8.0.5", "8.0.6", "8.0.8", "8.1.0", "8.1.1", "8.1.2", "8.1.3", "8.1.4", "8.2.0", "8.3.0", "8.3.1", "8.3.2", "8.3.3", "8.3.4", "8.3.5", "8.4.0", "8.5.0", "8.5.1", "9.0.0", "9.1.0", "9.2.0", "9.2.1", "9.2.2", "9.2.3", "9.2.4", "9.2.5", "9.2.6", "9.3.0", "9.3.1", "9.4.0", "9.5.0", "9.5.1", "9.5.2", "9.6.0", "9.7.0", "9.8.0", "9.8.1", "9.8.2", "9.8.3" ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-5vvx-3h34-f3gj/GHSA-5vvx-3h34-f3gj.json" }, "package": { "ecosystem": "PyPI", "name": "mpxj", "purl": "pkg:pypi/mpxj" }, "ranges": [ { "events": [ { "introduced": "5.5.5" }, { "fixed": "16.4.1" } ], "type": "ECOSYSTEM" } ], "versions": [ "10.0.0", "10.0.1", "10.0.2", "10.0.3", "10.0.4", "10.0.5", "10.1.0", "10.10.0", "10.11.0", "10.12.0", "10.13.0", "10.14.0", "10.14.1", "10.15.0", "10.16.0", "10.16.1", "10.16.2", "10.2.0", "10.3.0", "10.4.0", "10.5.0", "10.6.0", "10.6.1", "10.6.2", "10.7.0", "10.8.0", "10.9.0", "10.9.1", "11.0.0", "11.1.0", "11.2.0", "11.3.0", "11.3.1", "11.3.2", "11.4.0", "11.5.0", "11.5.1", "11.5.2", "11.5.3", "11.5.4", "12.0.0", "12.0.1", "12.0.2", "12.1.1", "12.1.2", "12.1.3", "12.10.0", "12.10.1", "12.10.2", "12.10.3", "12.2.0", "12.3.0", "12.4.0", "12.5.0", "12.6.0", "12.7.0", "12.8.0", "12.8.1", "12.9.0", "12.9.1", "12.9.2", "12.9.3", "13.0.0", "13.0.1", "13.0.2", "13.1.0", "13.10.0", "13.11.0", "13.12.0", "13.2.0", "13.2.1", "13.3.0", "13.3.1", "13.4.0", "13.4.1", "13.4.2", "13.5.0", "13.5.1", "13.6.0", "13.7.0", "13.8.0", "13.9.0", "14.0.0", "14.1.0", "14.2.0", "14.3.0", "14.3.1", "14.3.2", "14.3.3", "14.3.4", "14.3.5", "14.4.0", "14.5.0", "14.5.1", "14.5.2", "15.0.0", "15.1.0", "15.2.0", "15.3.0", "15.3.1", "16.0.0", "16.1.0", "16.2.0", "16.3.0", "16.4.0", "9.0.0", "9.1.0", "9.2.0", "9.2.1", "9.2.2", "9.2.3", "9.2.4", "9.2.5", "9.2.6", "9.3.0", "9.3.1", "9.4.0", "9.5.0", "9.5.1", "9.5.2", "9.6.0", "9.7.0", "9.8.0", "9.8.1", "9.8.2", "9.8.3" ] } ], "aliases": [ "CVE-2026-61570" ], "database_specific": { "cwe_ids": [ "CWE-611" ], "github_reviewed": true, "github_reviewed_at": "2026-09-22T20:34:25Z", "nvd_published_at": null, "severity": "HIGH" }, "details": "### Impact\nMPXJ used the default configuration when creating a DocumentBuilder instance, which leaves doctype declarations enabled, when parsing the XML content of the ZTIMEINTERVALS column from a Merlin project SQLite file. This would allow a carefully crafted XML payload to read an arbitrary file. However, although an arbitrary file can be read, the way the resulting parsed XML is processed by MPXJ means that the data it contains is unlikely to be available for exfiltration.\n\n### Patches\nThe patch is included in MPXJ 16.4.1\n\n### Workarounds\nPotential workarounds include:\n* Avoid reading Merlin project files with MPXJ\n* Only accept Merlin project files from trusted sources\n* Preprocess Merlin SQLite databases to strip doctype declarations from the ZTIMEINTERVALS column", "id": "GHSA-5vvx-3h34-f3gj", "modified": "2026-09-22T21:00:08.904047269Z", "published": "2026-09-22T20:34:25Z", "references": [ { "type": "WEB", "url": "https://github.com/joniles/mpxj/security/advisories/GHSA-5vvx-3h34-f3gj" }, { "type": "WEB", "url": "https://github.com/joniles/mpxj/commit/6e8288bc4d1cd62842af298004dc74fe66fb0805" }, { "type": "PACKAGE", "url": "https://github.com/joniles/mpxj" }, { "type": "WEB", "url": "https://github.com/joniles/mpxj/releases/tag/v16.4.1" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "type": "CVSS_V3" } ], "summary": "MPXJ: XXE Vulnerability in MerlinReader" }