What’s Vulnerable › Vulnerabilities
CVE-2025-4641: XML External Entity (XXE) injection vulnerability in WebDriverManager
- Severity: critical (CVSS 9.3 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-05-14 · updated 2026-06-17
- Weakness: CWE-611
Description
Improper Restriction of XML External Entity Reference vulnerability in bonigarcia webdrivermanager WebDriverManager on Windows, MacOS, Linux (XML parsing components modules) allows Data Serialization External Entities Blowup. This vulnerability is associated with program files src/main/java/io/github/bonigarcia/wdm/WebDriverManager.java. This issue affects webdrivermanager: from 1.0.0 before 6.0.2.
Affected products
- bonigarcia webdrivermanager: from 1.0.0 before 6.0.2 — fixed in 6.0.2
How to fix
Upgrade to a fixed version: bonigarcia webdrivermanager 6.0.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-4641 or the next vulnerability affects your stack