CVE-2026-15037
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Summary
Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Qt | Qt | 4.0.0 < 6.12.0 | affected |
Weaknesses
- CWE-91: CWE-91 XML injection (aka blind XPath injection)
Workarounds
On all affected versions, set the invalid-data policy before building documents:QDomImplementation::setInvalidDataPolicy(QDomImplementation::ReturnNullNode); (or DropInvalidChars). With ReturnNullNode, the QDom factory functions return a null node when given data that is invalid per XML 1.0 — check the return value. As additional defence-in-depth, validate untrusted input before inserting it and do not treat QDom output as trusted structure downstream.
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.