A vulnerability in GRASSMARLIN v3.2.1 allows an attacker to craft session data that triggers the parsing of XML external entity references, a weakness classified as CWE-611. The inadequate hardening of the XML parser permits the application to read data from external sources specified by the attacker, potentially exposing sensitive information that the system processes or stores.

The affected system is the NSA GRASSMARLIN project, version 3.2.1. No additional versions or vendors are listed in the advisory.

The CVSS score of 5.5 indicates moderate severity, and no EPSS score is available. The vulnerability is not listed in CISA KEV. The likely attack vector is an attacker able to submit crafted XML within session data—either through a remote interface that accepts XML input or via local manipulation of session files. Because the project is end‑of‑life and no patch exists, the only effective risk mitigation is to retire the application or enforce strict XML parsing safeguards.