CVE-2025-53103

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-53103

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53103.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-53103

Aliases

GHSA-m43g-m425-p68x

Downstream

UBUNTU-CVE-2025-53103

Published

2025-07-01T18:02:39.060Z

Modified

2026-07-22T04:02:20.857992Z

Severity

5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N CVSS Calculator

Summary

JUnit OpenTestReportGeneratingListener can leak Git credentials

Details

JUnit is a testing framework for Java and the JVM. From version 5.12.0 to 5.13.1, JUnit's support for writing Open Test Reporting XML files can leak Git credentials. The impact depends on the level of the access token exposed through the OpenTestReportGeneratingListener. If these test reports are published or stored anywhere public, then there is the possibility that a rouge attacker can steal the token and perform elevated actions by impersonating the user or app. This issue as been patched in version 5.13.2.

Database specific

{
    "cwe_ids": [
        "CWE-312"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53103.json"
}

References

Affected packages

Git / github.com/junit-team/junit-framework

Affected ranges

Type

GIT

Repo

https://github.com/junit-team/junit-framework

Events

Introduced

2750b0402e38fbed2c15ec47e8b422aa812a9e1e

Fixed

d4fc834c8c1c0b3168cd030c13551d1d041f51bc

Database specific

{
    "extracted_events": [
        {
            "introduced": "5.12.0"
        },
        {
            "fixed": "5.13.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Database specific

vanir_signatures

[
    {
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://github.com/junit-team/junit-framework/commit/d4fc834c8c1c0b3168cd030c13551d1d041f51bc",
        "target": {
            "function": "reportInfrastructure",
            "file": "junit-platform-reporting/src/main/java/org/junit/platform/reporting/open/xml/OpenTestReportGeneratingListener.java"
        },
        "id": "CVE-2025-53103-19d93981",
        "signature_type": "Function",
        "digest": {
            "function_hash": "335835310589599197389231669064691498903",
            "length": 705.0
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://github.com/junit-team/junit-framework/commit/d4fc834c8c1c0b3168cd030c13551d1d041f51bc",
        "target": {
            "function": "includesGitInfo",
            "file": "platform-tests/src/test/java/org/junit/platform/reporting/open/xml/OpenTestReportGeneratingListenerTests.java"
        },
        "id": "CVE-2025-53103-3024b673",
        "signature_type": "Function",
        "digest": {
            "function_hash": "108271908147857126895939468014511868824",
            "length": 1757.0
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://github.com/junit-team/junit-framework/commit/d4fc834c8c1c0b3168cd030c13551d1d041f51bc",
        "target": {
            "file": "platform-tests/src/test/java/org/junit/platform/reporting/open/xml/OpenTestReportGeneratingListenerTests.java"
        },
        "id": "CVE-2025-53103-6de15bfa",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "261426254682250202864802383716527731566",
                "258161724793779966040675193854503707395",
                "336110562769195220770290485985603780300",
                "145057905553854059446375412362133449205",
                "270396137703007572298461199054311856278",
                "142856259371544835599068424678475092663",
                "86413120235705393574621830487385953020",
                "225513133739995387308359452839456843237",
                "21218362819251589479798021390471816301",
                "171902074575976322374386075192847335275",
                "126068310011983839514904222508171580162",
                "254119698076190480874547033373584570650",
                "158023578485832796089984592209734871572",
                "311891209472553567192449388462572015951",
                "230413221226007179721867156860760320957",
                "244445031019333482366074651275849678967",
                "172677591617926408136863350318151547403",
                "97558672119369539924657650336769425313",
                "144105862636558875594526073311844532913",
                "330501678561529120030974650992326579758",
                "84753592375850575626204873625202801645",
                "82796073747361693902234034792620597616",
                "239193724793159908070943888588870113481",
                "106129464330510754743805540686920286370",
                "216394588881791922806095916606676327309",
                "118517574346754136660650529767800392563",
                "218155959951804731061863541139305345625",
                "77812615372744102864491043615656338021",
                "191786804593403030851946697967886536994",
                "12095397999655113356359678152837392740",
                "227845192921031779974842805223066711267",
                "22108591469477892112721457658969900429",
                "121177780805213381245847969356585121569",
                "47931504686469474195127373960376973065",
                "34595215067977456907383732618924015525",
                "163001359767999218266369791386612813864",
                "317986764686368218393013773237407553012",
                "188165128209707082537897032936228557734",
                "122169123877446306834407070216765981676",
                "277145060459229891874595716213423141351",
                "27414413828546611178538852124386653283",
                "134791990374805800243264595467171820722",
                "159681724286306815982761429188424423338",
                "91913905438412539154238304693049443904",
                "70504892188841366203960226661695495555",
                "247779477995812655594151528679675007547",
                "92019113295829726001922855196368979483",
                "331177155626621490149794930229991862104",
                "158100869272080395299120455715006093365",
                "170575944888697323775112750830002535266",
                "226946215788923771127693136987535449737",
                "96089749506155508805793832690488495633",
                "180910634699673043231219257366251642249"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://github.com/junit-team/junit-framework/commit/d4fc834c8c1c0b3168cd030c13551d1d041f51bc",
        "target": {
            "file": "junit-platform-reporting/src/main/java/org/junit/platform/reporting/open/xml/OpenTestReportGeneratingListener.java"
        },
        "id": "CVE-2025-53103-785037d2",
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "219604557305845057668052547753146428776",
                "144274806783149908017311036778956194096",
                "246587146452229886202003896635168399759",
                "220693160014543210602000580773444817323",
                "212705432073064610802524823901473050302",
                "4154942277433176078532552949918012087",
                "200282331091543673859325044531209036441",
                "301867848589907101925810928300254516914",
                "230605726344853240776017163455103828272",
                "280842574437925025062999401175017773380",
                "38546249183378011486059886400054899310",
                "69667503591202696602934208724483252069",
                "180398125293755178297631847998817121645",
                "71040755319076181774215762466815715566",
                "220037190013286159912265907123839187481",
                "66314943432807218134099542975710431798",
                "232708316731457937005267977512170635124",
                "186546395134139949504282820972579912787",
                "36198482195685266304920296568302238888",
                "200436799077547302213410963120394775158",
                "73399895440293302161229919420686899630",
                "129601624011762654904225687738244680395",
                "112324394457251795216103978714226531335",
                "175197988727234380404133828363008245027",
                "214624795396559327164538227460060241989",
                "105437572251862090255791185508011509285",
                "18555631561330841465311507908516509549",
                "237222631769109946990718997427332407572",
                "58817348483543961796172282744350623506",
                "186915417703724441334060002087948957288",
                "113936642074452090279010947854710194131",
                "190945975836538102007698514611539812875",
                "288999897734918589637614959429920174417",
                "50646786901978190444794308719675873348",
                "28945799250722741069142107981183454857",
                "287122430797363454654383376717780535707",
                "182531951327614509354968802328633024033",
                "68767683388926817504370517621023639640",
                "79765404561605838174439106149365427737",
                "310696282160263620166031032297174893313",
                "276019393707461362885973086191239397703",
                "118076566298896804417553211297611237652",
                "218714332689155672299908370935784393652",
                "37862540880465719228264837821039026397",
                "295784523878034962532623067394266361001",
                "335624186406418768311362379755471402864",
                "328244865929650880649136078827876217692",
                "811564014536572944755454502461196825",
                "191579899490965191557703150132166052390",
                "5467694493207475005962701327006104221",
                "192252265469549552805334812193427413807",
                "129219409737930069461464382590107217074",
                "331027462784540704682377943146864553550",
                "237071738460491304919106490676334309144",
                "224708994556976596325299983654163334695",
                "46255278080206684744603262335873400898",
                "96238137291614459963077974519714396615",
                "111587743514374207780077015489613504774",
                "22722700065753855673117981292376379091",
                "160449101251135637727361872929027578712",
                "147704846112428263762598193810690877067",
                "294459962438324192509887817594334648358",
                "168893705527748177041130625473120534143",
                "61851220534355726209632072200246889334",
                "108753510051349593915501191351736912475",
                "142478641630215945854992010088256627207",
                "32323332919118333336211447910935535549",
                "289529353077447814376372524795351980708",
                "50613164555014734421472605774352013398",
                "82580675522821711086531215129730352927",
                "240084022003321878733625967486793163247",
                "93457974590110475702818527673397951577",
                "207769373016667138324437912107451220527",
                "304154732097977889614128400272749240375",
                "289199755647792878512282524997010573209",
                "248178274090300584396856817877590326486",
                "99733070807018926955164189006970852899",
                "270636048870207571288494164809845304248",
                "113410014628201576327651313707696252464",
                "155949248827417544167068671657619044379",
                "267396165063768271686406785768374105475",
                "116384401927401450531522405347991294211",
                "328804691456537777454609493504234808625",
                "224413777125982872397266117567288501835",
                "171503928260868678471100361569924267759",
                "183367334945651406573169961331807640580",
                "239581877876580723708701131143285583044",
                "9402430377201499103402670366357605915",
                "175386863301062098516344983986204178233",
                "189831244430158600553865032770437074538",
                "179651434162674564209796264855543310092",
                "110255145225491287697714647953048078780",
                "196166513885280438486841460066376477359",
                "331074728398485904545934140940493294766",
                "103751577690475380146533297590209077125",
                "88638598689735882826916929946054357710",
                "277041628169824526571441957329183108537",
                "158345618225330257062299103343606917787",
                "305225019748826247216905775619496304502",
                "65252496019275838828881689491508629095",
                "172239136864033615657996663335981680031",
                "224435946391877806141174919891036314223",
                "245642661832538127918051953882154004551",
                "323631288691162492987348092200767575511",
                "236170927954802007808883771125374895186",
                "331362681385243913734747051109637457676",
                "331524898957273439776317530525823137290",
                "172424184748296310194730897832709866943",
                "282338232835313876425318940285065131294",
                "278895757267113349049223165025927335998",
                "182648446091514248038207163322823964806",
                "13326133392986483902599109496617777229",
                "213084856151762154896144489715993171347",
                "133078722404077149127228643542897920938",
                "155664379291971637954907127546467331048"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://github.com/junit-team/junit-framework/commit/d4fc834c8c1c0b3168cd030c13551d1d041f51bc",
        "target": {
            "function": "executeTests",
            "file": "platform-tests/src/test/java/org/junit/platform/reporting/open/xml/OpenTestReportGeneratingListenerTests.java"
        },
        "id": "CVE-2025-53103-a4c5c40d",
        "signature_type": "Function",
        "digest": {
            "function_hash": "318663307271808429230815728830518426294",
            "length": 525.0
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://github.com/junit-team/junit-framework/commit/d4fc834c8c1c0b3168cd030c13551d1d041f51bc",
        "target": {
            "function": "addGitInfo",
            "file": "junit-platform-reporting/src/main/java/org/junit/platform/reporting/open/xml/OpenTestReportGeneratingListener.java"
        },
        "id": "CVE-2025-53103-e816c2f2",
        "signature_type": "Function",
        "digest": {
            "function_hash": "105353795494242537133987868921712362440",
            "length": 862.0
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://github.com/junit-team/junit-framework/commit/d4fc834c8c1c0b3168cd030c13551d1d041f51bc",
        "target": {
            "function": "testPlanExecutionStarted",
            "file": "junit-platform-reporting/src/main/java/org/junit/platform/reporting/open/xml/OpenTestReportGeneratingListener.java"
        },
        "id": "CVE-2025-53103-eeb20e60",
        "signature_type": "Function",
        "digest": {
            "function_hash": "254596622229591377281822986950558835405",
            "length": 728.0
        }
    }
]

vanir_signatures_modified

"2026-07-22T04:02:20Z"

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53103.json"