diff --git a/blacklight-cornell/Gemfile b/blacklight-cornell/Gemfile
index 3e0f1ab50..e5bb39705 100644
--- a/blacklight-cornell/Gemfile
+++ b/blacklight-cornell/Gemfile
@@ -143,4 +143,4 @@ gem "uri", "0.12.2"
 gem "status-page"
 gem "concurrent-ruby", "1.2.3", require: "concurrent"
 gem "rack-cors", require: "rack/cors"
-gem "rexml", "3.2.6"
+gem "rexml", "3.3.9"
diff --git a/blacklight-cornell/Gemfile.lock b/blacklight-cornell/Gemfile.lock
index 6556e3fd8..11af93115 100644
--- a/blacklight-cornell/Gemfile.lock
+++ b/blacklight-cornell/Gemfile.lock
@@ -669,7 +669,7 @@ GEM
       http-cookie (>= 1.0.2, < 2.0)
       mime-types (>= 1.16, < 4.0)
       netrc (~> 0.8)
-    rexml (3.2.6)
+    rexml (3.3.9)
     rsolr (2.6.0)
       builder (>= 2.1.2)
       faraday (>= 0.9, < 3, != 2.0.0)
@@ -926,7 +926,7 @@ DEPENDENCIES
   rb-readline (~> 0.5.x)
   redis-session-store
   repost
-  rexml (= 3.2.6)
+  rexml (= 3.3.9)
   rsolr
   rspec
   rspec-rails