nuget package report

Is log4net safe?

3 known vulnerabilities, worst severity CRITICAL.

cvss

9.0

how bad it is if exploited, out of 10

epss

17.4%

chance of exploitation in the next 30 days

xyz score

4.9

CyberXYZ composite, out of 10

fig. 01 — GHSA-2cwj-8chv-9pp9, the advisory selected below

// advisories

GHSA-2cwj-8chv-9pp9

CRITICALCVE-2018-1285

Apache log4net before 2.0.10 does not disable XML external entities when parsing log4net configuration files. This could allow for XXE-based attacks in applications that accept arbitrary configuration files from users.

Affected: < 2.0.10
Fixed in: 2.0.10
Weakness: CWE-611
Published: 2021-01-29
Source: github

GHSA NVD MITRE reference reference reference reference reference reference reference reference reference

// dependencies

1 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so nuget packages are not covered.

Checked 2026-09-22 at 00:42 UTC. The most recent advisory here was published 2026-04-10. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is log4net safe? nuget package security report | CyberXYZ