← All advisories

Critical severityNVD Advisory· Published Mar 4, 2022· Updated Nov 3, 2025

Improper Restriction of XML External Entity Reference in liquibase/liquibase

CVE-2022-0839

Description

Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to 4.8.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.liquibase:liquibase-coreMaven	< 4.8.0	4.8.0

Affected products

2

ghsa-coords
pkg:maven/org.liquibase/liquibase-core
Range: < 4.8.0
Liquibase/liquibasecpe-rescue
Range: unspecified

Patches

Vulnerability mechanics

References

6

github.com/advisories/GHSA-jvfv-hrrc-6q72ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2022-0839ghsaADVISORY
seclists.org/fulldisclosure/2025/Apr/14ghsaWEB
github.com/liquibase/liquibase/commit/33d9d925082097fb1a3d2fc8e44423d964cd9381ghsax_refsource_MISCWEB
huntr.dev/bounties/f1ae5779-b406-4594-a8a3-d089c68d6e70ghsax_refsource_CONFIRMWEB
www.oracle.com/security-alerts/cpujul2022.htmlghsax_refsource_MISCWEB

News mentions

0

No linked articles in our index yet.