com.h2database:h2 XML External Entity (XXE) Injection

[chickenPopcorn]

We put the project through Snyk, and it reported a vulnerability. Can we take a look at it?

Introduced through
com.h2database:[email protected] and org.javalite:[email protected]
Exploit maturity: PROOF OF CONCEPT

Detailed paths
Introduced through: com.lyft.data:[email protected] › com.h2database:[email protected]
Fix: No remediation path available.
Introduced through: com.lyft.data:[email protected] › org.javalite:[email protected] › com.h2database:[email protected]
Fix: No remediation path available.
Overview
com.h2database:h2 is a database engine

Affected versions of this package are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability.

[endoplasmicR]

It seems suggesting a SQL injection vulnerability, but the message is not very clear. it would be useful to elaborate more on the location of the getSQLXML() call