In our project pom.xml we use flying-saucer-pdf-itext5 version 9.1.22, which has a dependency on itextpdf version 5.5.12. Our pipeline fails due to OWASP step complaining about itextpdf related to this security issue: https://nvd.nist.gov/vuln/detail/CVE-2021-43113

however this issue mentions that

iTextPDF in iText before 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.

which I guess is related to this dependency: itext7-core

We don't use this dependency directly and I also can't find it in dependencies of itextpdf.

I excluded the itextpdf 5.5.12 from flying-saucer-pdf-itext5 and added the newest version 5.5.13.2 but the issue still exists.

Any idea where I should look for this dependency and how to resolve this security issue?