Add CVSS 3.1 severity for GHSA-chfm-68vv-pvw5

[sunnypatell]

Changes

Added CVSS 3.1 scoring to GHSA-chfm-68vv-pvw5 (XMLUnit for Java insecure defaults when processing XSLT stylesheets).

• Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N (4.0 Medium)

CVSS justification

• AV:L - requires processing a malicious XSLT stylesheet locally (not remotely exploitable on its own)
• AC:H - exploitation depends on the application feeding untrusted XSLT to XMLUnit without additional security configuration
• C:L/I:L - insecure XSLT processing defaults could allow limited information disclosure or file writes via XSLT extension functions
• A:N - no direct denial of service impact from the misconfiguration

References

• NVD: CVE-2024-31573
• Security advisory
• Fix commit

[Copilot]

Pull request overview

This PR adds CVSS 3.1 severity scoring to the GitHub Security Advisory for CVE-2024-31573, which addresses insecure defaults in XMLUnit for Java when processing XSLT stylesheets. The CVSS vector assigns a Medium severity score of 4.0.

Changes:

• Added CVSS 3.1 scoring with vector string to the advisory JSON

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.