{"id":"CVE-2025-53103","summary":"JUnit OpenTestReportGeneratingListener can leak Git credentials","details":"JUnit is a testing framework for Java and the JVM. From version 5.12.0 to 5.13.1, JUnit's support for writing Open Test Reporting XML files can leak Git credentials. The impact depends on the level of the access token exposed through the OpenTestReportGeneratingListener. If these test reports are published or stored anywhere public, then there is the possibility that a rouge attacker can steal the token and perform elevated actions by impersonating the user or app. This issue as been patched in version 5.13.2.","aliases":["GHSA-m43g-m425-p68x"],"modified":"2026-08-12T15:14:01.666850Z","published":"2025-07-01T18:02:39.060Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53103.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-312"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53103.json"},{"type":"ADVISORY","url":"https://github.com/junit-team/junit-framework/security/advisories/GHSA-m43g-m425-p68x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53103"},{"type":"FIX","url":"https://github.com/junit-team/junit-framework/commit/d4fc834c8c1c0b3168cd030c13551d1d041f51bc"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/junit-team/junit-framework","events":[{"introduced":"2750b0402e38fbed2c15ec47e8b422aa812a9e1e"},{"fixed":"d4fc834c8c1c0b3168cd030c13551d1d041f51bc"}],"database_specific":{"extracted_events":[{"introduced":"5.12.0"},{"fixed":"5.13.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53103.json","vanir_signatures_modified":"2026-08-12T15:14:01Z","vanir_signatures":[{"source":"https://github.com/junit-team/junit-framework/commit/d4fc834c8c1c0b3168cd030c13551d1d041f51bc","target":{"file":"junit-platform-reporting/src/main/java/org/junit/platform/reporting/open/xml/OpenTestReportGeneratingListener.java","function":"reportInfrastructure"},"deprecated":false,"digest":{"function_hash":"335835310589599197389231669064691498903","length":705},"id":"CVE-2025-53103-19d93981","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/junit-team/junit-framework/commit/d4fc834c8c1c0b3168cd030c13551d1d041f51bc","target":{"function":"includesGitInfo","file":"platform-tests/src/test/java/org/junit/platform/reporting/open/xml/OpenTestReportGeneratingListenerTests.java"},"deprecated":false,"digest":{"function_hash":"108271908147857126895939468014511868824","length":1757},"id":"CVE-2025-53103-3024b673"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/junit-team/junit-framework/commit/d4fc834c8c1c0b3168cd030c13551d1d041f51bc","target":{"file":"platform-tests/src/test/java/org/junit/platform/reporting/open/xml/OpenTestReportGeneratingListenerTests.java"},"deprecated":false,"digest":{"line_hashes":["261426254682250202864802383716527731566","258161724793779966040675193854503707395","336110562769195220770290485985603780300","145057905553854059446375412362133449205","270396137703007572298461199054311856278","142856259371544835599068424678475092663","86413120235705393574621830487385953020","225513133739995387308359452839456843237","21218362819251589479798021390471816301","171902074575976322374386075192847335275","126068310011983839514904222508171580162","254119698076190480874547033373584570650","158023578485832796089984592209734871572","311891209472553567192449388462572015951","230413221226007179721867156860760320957","244445031019333482366074651275849678967","172677591617926408136863350318151547403","97558672119369539924657650336769425313","144105862636558875594526073311844532913","330501678561529120030974650992326579758","84753592375850575626204873625202801645","82796073747361693902234034792620597616","239193724793159908070943888588870113481","106129464330510754743805540686920286370","216394588881791922806095916606676327309","118517574346754136660650529767800392563","218155959951804731061863541139305345625","77812615372744102864491043615656338021","191786804593403030851946697967886536994","12095397999655113356359678152837392740","227845192921031779974842805223066711267","22108591469477892112721457658969900429","121177780805213381245847969356585121569","47931504686469474195127373960376973065","34595215067977456907383732618924015525","163001359767999218266369791386612813864","317986764686368218393013773237407553012","188165128209707082537897032936228557734","122169123877446306834407070216765981676","277145060459229891874595716213423141351","27414413828546611178538852124386653283","134791990374805800243264595467171820722","159681724286306815982761429188424423338","91913905438412539154238304693049443904","70504892188841366203960226661695495555","247779477995812655594151528679675007547","92019113295829726001922855196368979483","331177155626621490149794930229991862104","158100869272080395299120455715006093365","170575944888697323775112750830002535266","226946215788923771127693136987535449737","96089749506155508805793832690488495633","180910634699673043231219257366251642249"],"threshold":0.9},"id":"CVE-2025-53103-6de15bfa"},{"target":{"file":"junit-platform-reporting/src/main/java/org/junit/platform/reporting/open/xml/OpenTestReportGeneratingListener.java"},"deprecated":false,"digest":{"line_hashes":["219604557305845057668052547753146428776","144274806783149908017311036778956194096","246587146452229886202003896635168399759","220693160014543210602000580773444817323","212705432073064610802524823901473050302","4154942277433176078532552949918012087","200282331091543673859325044531209036441","301867848589907101925810928300254516914","230605726344853240776017163455103828272","280842574437925025062999401175017773380","38546249183378011486059886400054899310","69667503591202696602934208724483252069","180398125293755178297631847998817121645","71040755319076181774215762466815715566","220037190013286159912265907123839187481","66314943432807218134099542975710431798","232708316731457937005267977512170635124","186546395134139949504282820972579912787","36198482195685266304920296568302238888","200436799077547302213410963120394775158","73399895440293302161229919420686899630","129601624011762654904225687738244680395","112324394457251795216103978714226531335","175197988727234380404133828363008245027","214624795396559327164538227460060241989","105437572251862090255791185508011509285","18555631561330841465311507908516509549","237222631769109946990718997427332407572","58817348483543961796172282744350623506","186915417703724441334060002087948957288","113936642074452090279010947854710194131","190945975836538102007698514611539812875","288999897734918589637614959429920174417","50646786901978190444794308719675873348","28945799250722741069142107981183454857","287122430797363454654383376717780535707","182531951327614509354968802328633024033","68767683388926817504370517621023639640","79765404561605838174439106149365427737","310696282160263620166031032297174893313","276019393707461362885973086191239397703","118076566298896804417553211297611237652","218714332689155672299908370935784393652","37862540880465719228264837821039026397","295784523878034962532623067394266361001","335624186406418768311362379755471402864","328244865929650880649136078827876217692","811564014536572944755454502461196825","191579899490965191557703150132166052390","5467694493207475005962701327006104221","192252265469549552805334812193427413807","129219409737930069461464382590107217074","331027462784540704682377943146864553550","237071738460491304919106490676334309144","224708994556976596325299983654163334695","46255278080206684744603262335873400898","96238137291614459963077974519714396615","111587743514374207780077015489613504774","22722700065753855673117981292376379091","160449101251135637727361872929027578712","147704846112428263762598193810690877067","294459962438324192509887817594334648358","168893705527748177041130625473120534143","61851220534355726209632072200246889334","108753510051349593915501191351736912475","142478641630215945854992010088256627207","32323332919118333336211447910935535549","289529353077447814376372524795351980708","50613164555014734421472605774352013398","82580675522821711086531215129730352927","240084022003321878733625967486793163247","93457974590110475702818527673397951577","207769373016667138324437912107451220527","304154732097977889614128400272749240375","289199755647792878512282524997010573209","248178274090300584396856817877590326486","99733070807018926955164189006970852899","270636048870207571288494164809845304248","113410014628201576327651313707696252464","155949248827417544167068671657619044379","267396165063768271686406785768374105475","116384401927401450531522405347991294211","328804691456537777454609493504234808625","224413777125982872397266117567288501835","171503928260868678471100361569924267759","183367334945651406573169961331807640580","239581877876580723708701131143285583044","9402430377201499103402670366357605915","175386863301062098516344983986204178233","189831244430158600553865032770437074538","179651434162674564209796264855543310092","110255145225491287697714647953048078780","196166513885280438486841460066376477359","331074728398485904545934140940493294766","103751577690475380146533297590209077125","88638598689735882826916929946054357710","277041628169824526571441957329183108537","158345618225330257062299103343606917787","305225019748826247216905775619496304502","65252496019275838828881689491508629095","172239136864033615657996663335981680031","224435946391877806141174919891036314223","245642661832538127918051953882154004551","323631288691162492987348092200767575511","236170927954802007808883771125374895186","331362681385243913734747051109637457676","331524898957273439776317530525823137290","172424184748296310194730897832709866943","282338232835313876425318940285065131294","278895757267113349049223165025927335998","182648446091514248038207163322823964806","13326133392986483902599109496617777229","213084856151762154896144489715993171347","133078722404077149127228643542897920938","155664379291971637954907127546467331048"],"threshold":0.9},"id":"CVE-2025-53103-785037d2","signature_type":"Line","signature_version":"v1","source":"https://github.com/junit-team/junit-framework/commit/d4fc834c8c1c0b3168cd030c13551d1d041f51bc"},{"digest":{"function_hash":"318663307271808429230815728830518426294","length":525},"id":"CVE-2025-53103-a4c5c40d","signature_type":"Function","signature_version":"v1","source":"https://github.com/junit-team/junit-framework/commit/d4fc834c8c1c0b3168cd030c13551d1d041f51bc","target":{"file":"platform-tests/src/test/java/org/junit/platform/reporting/open/xml/OpenTestReportGeneratingListenerTests.java","function":"executeTests"},"deprecated":false},{"source":"https://github.com/junit-team/junit-framework/commit/d4fc834c8c1c0b3168cd030c13551d1d041f51bc","target":{"file":"junit-platform-reporting/src/main/java/org/junit/platform/reporting/open/xml/OpenTestReportGeneratingListener.java","function":"addGitInfo"},"deprecated":false,"digest":{"function_hash":"105353795494242537133987868921712362440","length":862},"id":"CVE-2025-53103-e816c2f2","signature_type":"Function","signature_version":"v1"},{"target":{"file":"junit-platform-reporting/src/main/java/org/junit/platform/reporting/open/xml/OpenTestReportGeneratingListener.java","function":"testPlanExecutionStarted"},"deprecated":false,"digest":{"function_hash":"254596622229591377281822986950558835405","length":728},"id":"CVE-2025-53103-eeb20e60","signature_type":"Function","signature_version":"v1","source":"https://github.com/junit-team/junit-framework/commit/d4fc834c8c1c0b3168cd030c13551d1d041f51bc"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N"}]}