Vulnerability · Published Jul 1, 2025 · Assigned by GitHub_M
CVE-2025-53103JUnit OpenTestReportGeneratingListener can leak Git credentials
Medium 5.8
In plain English
A medium-severity security flaw in junit-framework from junit-team. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
JUnit is a testing framework for Java and the JVM. From version 5.12.0 to 5.13.1, JUnit's support for writing Open Test Reporting XML files can leak Git credentials. The impact depends on the level of the access token exposed through the OpenTestReportGeneratingListener. If these test reports are published or stored anywhere public, then there is the possibility that a rouge attacker can steal the token and perform elevated actions by impersonating the user or app. This issue as been patched in version 5.13.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.junit.platform:junit-platform-reporting | 5.13.2 | GHSA-m43g-m425-p68x |
| Ubuntu:22.04:LTS | junit5 | no fix listed | UBUNTU-CVE-2025-53103 |
| Ubuntu:24.04:LTS | junit5 | no fix listed | UBUNTU-CVE-2025-53103 |
| Ubuntu:25.10 | junit5 | no fix listed | UBUNTU-CVE-2025-53103 |
| Ubuntu:26.04:LTS | junit5 | no fix listed | UBUNTU-CVE-2025-53103 |
| Ubuntu:26.10 | junit5 | no fix listed | UBUNTU-CVE-2025-53103 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| junit-team | junit-framework | >= 5.12.0, < 5.13.2 |
Weakness: CWE-312 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N