CVE-2024-31573: 
Java 脆弱性の分析と軽減

CVE-2024-31573 affects XMLUnit for Java versions prior to 2.10.0. The vulnerability stems from insecure default settings when processing XSLT stylesheets, where XSLT extension functions were not disabled by default (GitHub Advisory).

The vulnerability exists in XMLUnit's XSLT transformation functionality where extension functions were enabled by default. This configuration could allow arbitrary code execution when processing untrusted stylesheets. The issue specifically relates to the TransformerFactoryConfigurer component, which did not have extension functions disabled in its default configuration (GitHub Commit).

When XMLUnit is used to transform data with a stylesheet from an untrusted source, this vulnerability could potentially lead to arbitrary code execution. In cases where the stylesheet can be provided externally, this may result in remote code execution (GitHub Advisory).

Users are advised to upgrade to XMLUnit for Java 2.10.0 where the default settings have been secured. For those unable to upgrade, a workaround is available by explicitly using XMLUnit's APIs to pass in a pre-configured TraX TransformerFactory with extension functions disabled via features and attributes. The setFactory or setTransformerFactory methods, available since XMLUnit for Java 2.0.0, can be used for this purpose (GitHub Advisory).