AVID-2026-R0882

Description

Improper Restriction of XML External Entity Reference in stanfordnlp/corenlp (CVE-2021-3878)

Details

corenlp is vulnerable to Improper Restriction of XML External Entity Reference

Reason for inclusion in AVID: CVE-2021-3878 describes an XML External Entity (XXE) vulnerability in stanfordnlp/corenlp. CoreNLP is a widely used NLP library in AI pipelines, so this directly concerns AI software, models, and tooling. The issue affects a software component used to build/run AI systems (dependencies in NLP stacks), representing a software supply chain vulnerability. It is a security vulnerability with network-exploitable characteristics (RCE-like impact via XXE) and has clear CVSS evidence. Therefore, this should be kept for AVID curation as a vulnerability in the general-purpose AI software supply chain.

References

Affected or Relevant Artifacts

Developer: stanfordnlp
Deployer: stanfordnlp
Artifact Details:

Type	Name
System	stanfordnlp/corenlp

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.0
Vector String	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score	9.8
Base Severity	🔴 Critical
Attack Vector	NETWORK
Attack Complexity	🟢 Low
Privileges Required	NONE
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	🔴 High
Integrity Impact	🔴 High
Availability Impact	🔴 High

CWE

ID	Description
CWE-611	CWE-611 Improper Restriction of XML External Entity Reference

Other information

Report Type: Advisory
Credits:
Date Reported: 2021-10-15
Version: 0.3.3
AVID Entry