{"cve":"CVE-2024-52800","nvd":{"published":"2024-11-29T19:15:08.713","modified":"2026-06-17T08:07:39.087","status":"Deferred","description":"veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability. This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust. This issue has not yet been patched. Users are advised to be cautious of XSLT code until a patch is available.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","score":2.3},"cvss_v3":null,"cwes":["CWE-611"],"references":["https://github.com/veraPDF/veraPDF-library/issues/1488","https://github.com/veraPDF/veraPDF-library/security/advisories/GHSA-4cx5-89vm-833x"],"products":[],"source":"nvd","synced_at":"2026-10-19T21:57:34.731061660+00:00"},"epss":{"cve":"CVE-2024-52800","score":0.01108,"percentile":0.65887,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-4cx5-89vm-833x","url":"https://osv.dev/vulnerability/GHSA-4cx5-89vm-833x","summary":"veraPDF CLI has potential XXE (XML External Entity Injection) vulnerability","modified":"2026-05-14T21:03:54.873106Z","packages":[{"ecosystem":"Maven","name":"org.verapdf:core","purl":"pkg:maven/org.verapdf/core","ranges":["<1.26.2"],"fixed":["1.26.2"]},{"ecosystem":"Maven","name":"org.verapdf:core-jakarta","purl":"pkg:maven/org.verapdf/core-jakarta","ranges":["<1.26.2"],"fixed":["1.26.2"]},{"ecosystem":"Maven","name":"org.verapdf:core-arlington","purl":"pkg:maven/org.verapdf/core-arlington","ranges":["<1.26.2"],"fixed":["1.26.2"]},{"ecosystem":"Maven","name":"org.verapdf:verapdf-library","purl":"pkg:maven/org.verapdf/verapdf-library","ranges":["<1.26.2"],"fixed":["1.26.2"]},{"ecosystem":"Maven","name":"org.verapdf:verapdf-library-jakarta","purl":"pkg:maven/org.verapdf/verapdf-library-jakarta","ranges":["<1.26.2"],"fixed":["1.26.2"]},{"ecosystem":"Maven","name":"org.verapdf:verapdf-library-arlington","purl":"pkg:maven/org.verapdf/verapdf-library-arlington","ranges":["<1.26.2"],"fixed":["1.26.2"]},{"ecosystem":"Maven","name":"org.verapdf:library","purl":"pkg:maven/org.verapdf/library","ranges":["<1.26.2"],"fixed":["1.26.2"]},{"ecosystem":"Maven","name":"org.verapdf:library-jakarta","purl":"pkg:maven/org.verapdf/library-jakarta","ranges":["<1.26.2"],"fixed":["1.26.2"]},{"ecosystem":"Maven","name":"org.verapdf:library-arlington","purl":"pkg:maven/org.verapdf/library-arlington","ranges":["<1.26.2"],"fixed":["1.26.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}