https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T03:11:14.397914+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-161191 EUVD-2026-161191 2026-10-05T03:11:14.403949+00:00 EUVD-2026-161191 https://cve.radiocsirt.org/vuln/fkie_cve-2023-4218 fkie_cve-2023-4218 2026-10-05T03:11:14.403993+00:00

In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).

 https://cve.radiocsirt.org/vuln/ghsa-j24h-xcpc-9jw8 GHSA-j24h-xcpc-9jw8 — Eclipse IDE XXE in eclipse.platform 2026-10-05T03:11:14.404028+00:00

Affected: Maven: org.eclipse.platform:org.eclipse.core.runtime, Maven: org.eclipse.platform:org.eclipse.platform, Maven: org.eclipse.platform:org.eclipse.jface, Maven: org.eclipse.platform:org.eclipse.ui.forms, Maven: org.eclipse.platform:org.eclipse.ui.ide, Maven: org.eclipse.platform:org.eclipse.ui.workbench, Maven: org.eclipse.platform:org.eclipse.urischeme, Maven: org.eclipse.jdt:org.eclipse.jdt.ui

### Impact xml files like ".project" are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).

Vulnerablility was found by static code analysis (SonarLint).

Example `.project` file: ``` <?xml version="1.0" encoding="utf-8"?> <!DOCTYPE price [ <!ENTITY xxe SYSTEM "http://127.0.0.1:49416/evil">]> <projectDescription> <name>p</name> <comment>&xxe;</comment> </projectDescription> ```

### Patches Similar patches including junit test that shows the vulnerability have already applied to PDE (see https://github.com/eclipse-pde/eclipse.pde/pull/667). A solution to platform should be the same: just reject parsing any XML that contains any `DOCTYPE`.

### Workarounds No known workaround. User can only avoid to get/open any foreign files with eclipse. Firewall rules against loss of data (but not against XML bomb).

### References https://cwe.mitre.org/data/definitions/611.html https://rules.sonarsource.com/java/RSPEC-2755 https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/8 (Report for multiple projects affected)

 https://cve.radiocsirt.org/vuln/gsd-2023-4218 gsd-2023-4218 2026-10-05T03:11:14.404079+00:00 gsd-2023-4218 https://cve.radiocsirt.org/vuln/opensuse-su-2024:13786-1 openSUSE-SU-2024:13786-1 — eclipse-contributor-tools-4.15-13.1 on GA media 2026-10-05T03:11:14.404092+00:00

eclipse-contributor-tools-4.15-13.1 on GA media

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-4218 UBUNTU-CVE-2023-4218 2026-10-05T03:11:14.404110+00:00

Affected: Ubuntu:16.04:LTS: eclipse, Ubuntu:18.04:LTS: eclipse

In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-3034 WID-SEC-W-2023-3034 — Eclipse IDE: Schwachstelle ermöglicht Offenlegung von Informationen 2026-10-05T03:11:14.404131+00:00

Ein lokaler Angreifer kann eine Schwachstelle in Eclipse IDE ausnutzen, um Informationen offenzulegen.