AssertJ contains an XXE vulnerability in the XmlStringPrettyFormatter used by the isXmlEqualTo assertion for CharSequence values. The formatter initializes a DocumentBuilderFactory with default settings, allowing the parser to process external entities. An attacker can cause the library to read arbitrary local files through file:// URIs, perform Server‑Side Request Forgery to external HTTP or HTTPS resources, and trigger denial of service by exploiting entity expansion attacks. The flaw corresponds to CWE‑611 (XML External Entity (XXE) Processing).

The vulnerable code exists in AssertJ versions from 1.4.0 up to 3.27.6, inclusive. It affects the AssertJ library (assertj:assertj) when its isXmlEqualTo(CharSequence) assertion or the XmlStringPrettyFormatter are used with XML data that can be controlled by an attacker.

The CVSS score of 8.2 indicates a high severity impact if successfully exploited. However, the EPSS score of <1% shows a very low likelihood that attackers have found or will use exploits in the wild, and the vulnerability is not listed in the CISA KEV catalogue. The typical attack scenario requires the application to pass untrusted XML input into the isXmlEqualTo or XmlStringPrettyFormatter methods, which may occur in test suites or build pipelines that ingest external XML. While the vector is not publicly exploitable in a generic remote context, any environment where untrusted XML is processed by AssertJ remains at risk.