Description
JUnit is a testing framework for Java and the JVM. From version 5.12.0 to 5.13.1, JUnit's support for writing Open Test Reporting XML files can leak Git credentials. The impact depends on the level of the access token exposed through the OpenTestReportGeneratingListener. If these test reports are published or stored anywhere public, then there is the possibility that a rouge attacker can steal the token and perform elevated actions by impersonating the user or app. This issue as been patched in version 5.13.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| junit-team | junit-framework | >= 5.12.0, < 5.13.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | junit5 | No fix yet | — |
| Ubuntu 26.04 LTS | junit5 | No fix yet | — |
| Ubuntu 25.10 | junit5 | No fix yet | — |
| Ubuntu 24.04 LTS | junit5 | No fix yet | — |
| Ubuntu 22.04 LTS | junit5 | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | junit5 | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.junit.platform:junit-platform-reporting | >= 5.12.0, < 5.13.2 | 5.13.2 | GHSA-m43g-m425-p68x |
Advisories 1
- WID-SEC-2025-1443 Junit: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Jul 1, 2025