CVE catalog

CVE-2025-53103

junit5: CVE-2025-53103

[CVE catalog]

Severity
Medium · CVSS 5.8CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.11% · Oct 25, 2026

JUnit is a testing framework for Java and the JVM. From version 5.12.0 to 5.13.1, JUnit's support for writing Open Test Reporting XML files can leak Git credentials. The impact depends on the level of the access token exposed through the OpenTestReportGeneratingListener. If these test reports are published or stored anywhere public, then there is the possibility that a rouge attacker can steal the token and perform elevated actions by impersonating the user or app. This issue as been patched in version 5.13.2.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianjunit5sid5.14.4-2not affected
Debianjunit5forky5.14.4-2not affected
Debianjunit5trixie5.10.3-1not affected
Debianjunit5bookworm5.9.2-1not affected

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianjunit5sourcesidNot affectedunimportantNot reportedNot reported
Debianjunit5sourceforkyNot affectedunimportantNot reportedNot reported
Debianjunit5sourcetrixieNot affectedunimportantNot reportedNot reported
Debianjunit5sourcebookwormNot affectedunimportantNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [junit5]Not affected
    Details (2)

    • 5.9.2-1 · all · bookworm

      Not affected

      dsa · junit5 · debian · bookworm

    • 5.9.2-1 · all · bookworm

      Not affected

      dsa · junit5 · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [Red Hat security advisories and VEX]