Spring REST Docs versions 4.0.0, 3.0.0 to 3.0.5, and 2.0.0.RELEASE to 2.0.8.RELEASE are vulnerable to an XML External Entity (XXE) injection vulnerability (CWE-611). This occurs when using spring-restdocs-webtestclient or spring-restdocs-restassured to document remote APIs accessed over HTTP. If an attacker compromises the API or tricks the user into documenting a malicious API, they can exploit this vulnerability to perform XXE injection during the execution of documentation-generating tests. The vulnerability allows an attacker to cause high confidentiality impact by potentially exposing sensitive data, with no integrity impact and low availability impact. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L, indicating network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, no integrity impact, and low availability impact. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

Successful exploitation can lead to disclosure of sensitive information due to XXE injection when documenting a malicious or compromised remote API. The confidentiality impact is high, while integrity is not affected and availability impact is low. This vulnerability requires user interaction and has a high attack complexity, limiting ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid documenting untrusted or potentially compromised remote APIs using spring-restdocs-webtestclient or spring-restdocs-restassured. Review test configurations and consider additional input validation or XML parsing hardening if feasible.