Executive brief
Spring REST Docs is a library used by developers to automatically generate documentation for web APIs. A security vulnerability exists where the tool improperly handles XML data when documenting remote services. If a developer is tricked into documenting a malicious API or if a documented API is compromised, an attacker could potentially read sensitive files from the developer's machine or the build server during the documentation process.
Technical details
Spring REST Docs (specifically the spring-restdocs-webtestclient and spring-restdocs-restassured modules) is vulnerable to XML External Entity (XXE) injection (CWE-611). The vulnerability occurs when the library processes XML responses from a remote API to generate documentation. An attacker who controls the target API can provide a malicious XML payload containing external entity references. When the documentation-generating tests are executed, the XML parser may resolve these entities, allowing the attacker to perform unauthorized data retrieval (such as local file disclosure) or server-side request forgery (SSRF). The attack requires the user to execute tests against a malicious or compromised endpoint. The issue is addressed in versions 3.0.6 and 4.0.1.
Affected products
- Spring Spring REST Docs 4.0.0, 3.0.0 - 3.0.5, 2.0.0.RELEASE - 2.0.8.RELEASE
Timeline
- 2026-06-09: patched: Versions 3.0.6 and 4.0.1 released
- 2026-06-10: disclosed: Initial advisory publication
- 2026-08-12: advisory: GitHub Advisory updated