What’s Vulnerable › Vulnerabilities

CVE-2022-0198: Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-01-13 · updated 2026-06-17
• Weakness: CWE-611

Description

corenlp is vulnerable to Improper Restriction of XML External Entity Reference

Affected products

• stanfordnlp/corenlp: through 4.3.2

References

• https://github.com/stanfordnlp/corenlp/commit/1f52136321cfca68b991bd7870563d06cf96624d
• https://huntr.dev/bounties/3d7e70fe-dddd-4b79-af62-8e058c4d5763
• https://github.com/stanfordnlp/corenlp/commit/1f52136321cfca68b991bd7870563d06cf96624d
• https://huntr.dev/bounties/3d7e70fe-dddd-4b79-af62-8e058c4d5763

Get alerted when CVE-2022-0198 or the next vulnerability affects your stack