What’s Vulnerable › Vulnerabilities

CVE-2019-9843

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-06-28 · updated 2026-06-17
• Weakness: CWE-611

Description

In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a victim performs a spotlessApply operation on an untrusted XML file.

Affected products

• Diffplug Gradle: before 3.20.0 — fixed in 3.20.0
• Diffplug Maven: before 1.20.0 — fixed in 1.20.0

How to fix

Upgrade to a fixed version: Diffplug Gradle 3.20.0; Diffplug Maven 1.20.0. Check the vendor advisory for mitigations.

References

• https://github.com/diffplug/spotless/blob/master/plugin-gradle/CHANGES.md#version-3200---march-11th-2018-javadoc-jcenter
• https://github.com/diffplug/spotless/blob/master/plugin-maven/CHANGES.md#version-1200---march-14th-2018-javadoc-jcenter
• https://github.com/diffplug/spotless/issues/358
• https://github.com/diffplug/spotless/pull/369
• https://lists.apache.org/thread.html/r7406e297228c42deeecdd12a576e39d63073faebf14b027b7608fdfd%40%3Cissues.iceberg.apache.org%3E
• https://github.com/diffplug/spotless/blob/master/plugin-gradle/CHANGES.md#version-3200---march-11th-2018-javadoc-jcenter
• https://github.com/diffplug/spotless/blob/master/plugin-maven/CHANGES.md#version-1200---march-14th-2018-javadoc-jcenter
• https://github.com/diffplug/spotless/issues/358
• https://github.com/diffplug/spotless/pull/369
• https://lists.apache.org/thread.html/r7406e297228c42deeecdd12a576e39d63073faebf14b027b7608fdfd%40%3Cissues.iceberg.apache.org%3E

Get alerted when CVE-2019-9843 or the next vulnerability affects your stack