The Jenkins JDepend Plugin version 1.3.1 and earlier contains an XML external entity (XXE) vulnerability due to an outdated JDepend Maven Plugin that does not properly configure its XML parser. This flaw allows attackers who can control input files for the 'Report JDepend' step to craft malicious XML that can lead to extraction of secrets from the Jenkins controller or enable server-side request forgery. No fix is currently available for this vulnerability.