diff --git a/METADATA b/METADATA
index d97975c..0276872 100644
--- a/METADATA
+++ b/METADATA
@@ -1,3 +1,6 @@
 third_party {
   license_type: NOTICE
+  security {
+      tag: "NVD-CPE2.3:cpe:/a:apache:xalan-java:2.7.1"
+  }
 }