corenlp is vulnerable to Improper Restriction of XML External Entity Reference

CRITICAL 9.8CVE-2022-0239 · GHSA-75vw-3m5v-fprh · Published 17/01/2022 · updated 17/06/2026

In short

CVE-2022-0239 is a CRITICAL (CVSS 9.8) vulnerability affecting edu.stanford.nlp:stanford-corenlp, corenlp (stanford).
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 68.6% of all vulnerabilities.
Fix: update to 4.4.0 or later.

Package	Affected versions	Patched versions
edu.stanford.nlp:stanford-corenlp Maven	`< 4.4.0`	`4.4.0`
corenlp stanford	`< 4.4.0`	`4.4.0`

NVD description

corenlp is vulnerable to Improper Restriction of XML External Entity Reference

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Maven

< 4.4.0

4.4.0

< 4.4.0

4.4.0

More vulnerabilities in edu.stanford.nlp:stanford-corenlp

See all →