CVE-2023-4218: Eclipse IDE

Medium severity, CVSS 5.0. EPSS: 0.4% chance of exploitation in the next 30 days.

In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign repository or patch).

Affected products

• Eclipse Eclipse IDE: before 4.29 (fixed in 4.29)
• Eclipse Org.eclipse.core.runtime: before 3.29.0 (fixed in 3.29.0)
• Eclipse Pde: before 3.13.2400 (fixed in 3.13.2400)

Published 2023-11-09. Last modified 2026-06-17.