AutoUpdater.NET allows XXE

CRITICAL 9.8CVE-2019-20627 · GHSA-75p2-hgw4-g7f7 · Published 23/03/2020 · updated 17/06/2026

In short

CVE-2019-20627 is a CRITICAL (CVSS 9.8) vulnerability affecting Autoupdater.NET.Official, autoupdater.net (rbsoft).
Chance of exploitation in the next 30 days (EPSS): 2.3%, higher than 83.7% of all vulnerabilities.
Fix: update to 1.5.8 or later.

Package	Affected versions	Patched versions
Autoupdater.NET.Official NuGet	`< 1.5.8`	`1.5.8`
autoupdater.net rbsoft	`< 1.5.8`	`1.5.8`

AutoUpdater.cs in AutoUpdater.NET before 1.5.8 allows XXE.

NVD description

AutoUpdater.cs in AutoUpdater.NET before 1.5.8 allows XXE.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.