CVE-2022-0839: Liquibase

Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days.

Improper Restriction of XML External Entity Reference in GitHub repository liquibase/liquibase prior to 4.8.0.

Affected products

• Liquibase Liquibase: before 4.8.0 (fixed in 4.8.0)
• Oracle Sqlcl: version 19c only

Published 2022-03-04. Last modified 2026-06-17.