CVE-2021-47621 – XML External Entity (XXE)

Abstract

ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.

The Oxygen products incorporate ClassGraph (io.github.classgraph:classgraph) as a third‑party library. This advisory was opened to address the potential impact of this third‑party library vulnerability.

Affected Products/Versions

Mitigation

None

Detail

CVE-2021-47621

Severity: High

CVSS Score: 7.5

ClassGraph prior to 4.8.112 is susceptible to XML External Entity (XXE) issues. If attacker‑controlled XML is parsed by the library with external entity resolution enabled, it could lead to unintended file disclosure or outbound network requests under the application’s privileges.

We reviewed how this library is used in our code and confirmed no user‑controlled XML is parsed through ClassGraph. On that basis, our product is not exploitable via this issue.

. We updated the dependency to a non-vulnerable version in Oxygen Feedback 5.2.3 build 2025071110.