AIKIDO-2026-776096
validator is vulnerable to Server-Side Request Forgery (SSRF)
31
Low Risk
This Affects:
validatorTL;DR
In the non-default STRICT_LOCAL mode the validator's StrictLocalResolvingStrategy returns a null URI resolver, so Saxon resolves xsl:include and xsl:import hrefs during stylesheet compilation without any restriction. A validation configuration whose stylesheets contain remote includes therefore makes the validator fetch and compile stylesheets from arbitrary URLs, issuing requests to externally influenced endpoints and compiling untrusted code, contradicting the mode's documented local-only guarantee. On older Saxon versions this could also read local files into validation reports. The fix adds a LocalUriResolver that restricts resolution to file and jar URIs and rejects remote schemes.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run the validator in the non-default STRICT_LOCAL mode with a validation scenario whose stylesheets can include externally influenced xsl:include or xsl:import references.
Background info
validator is vulnerable to Server-Side Request Forgery (SSRF) in versions 1.3.0 - 1.6.2.
How to fix this
Upgrade the validator and/or the org.kosit:validator library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant