Threats affecting pkg:maven/eu.copernik/copernik-xml-factory

Copernik XML Factory versions prior to 0.1.2 have an XML External Entity (XXE) vulnerability due to improper restriction of XML External Entity references when XInclude is enabled. This allows an attacker to cause the application to resolve attacker-controlled xi:include references, potentially disclosing local files or making server-side requests to internal network endpoints. The vulnerability requires specific conditions including use of the stock JDK provider without Apache Xerces, explicit enabling of XInclude, and parsing XML from untrusted sources. The issue is fixed in version 0.1.2.