Description
The XSLT Transformer Step builds a bare TransformerFactory without the proper security options set, so XXE injection can allow data exfiltration and denial-of-service attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| NextGen Healthcare | Mirth Connect | ≤ 4.7.1 | 4.7.2 |
Advisories 1
- ICSMA-26-253-01 NextGen Healthcare Mirth Connect CISA ICS & IT advisories · Sep 10, 2026