CVE-2026-15037 - Vulnerability Details - OpenCVE

Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Qt	Qt

No data.

No data.

No data.

References

Link	Providers
https://codereview.qt-project.org/c/qt/qtbase/+/748323

History

Thu, 23 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 23 Jul 2026 13:00:00 +0000

Type	Values Removed	Values Added
Description		Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.
Title		XML injection vulnerability in QDom comment, CDATA and processing-instruction serialization
First Time appeared		Qt Qt qt
Weaknesses		CWE-91
CPEs		cpe:2.3:a:qt:qt::::::::
Vendors & Products		Qt Qt qt
References		https://codereview.qt-project.org/c/qt/qtbase/+/748323
Metrics		cvssV4_0 `{'score': 2.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}`

MITRE

Status: PUBLISHED

Assigner: TQtC

Published: 2026-07-23T12:33:11.068Z

Updated: 2026-07-23T14:45:39.734Z

Reserved: 2026-07-08T08:35:17.940Z

Link: CVE-2026-15037

Vulnrichment

Updated: 2026-07-23T14:45:35.678Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15037", "assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "state": "PUBLISHED", "assignerShortName": "TQtC", "dateReserved": "2026-07-08T08:35:17.940Z", "datePublished": "2026-07-23T12:33:11.068Z", "dateUpdated": "2026-07-23T14:45:39.734Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "shortName": "TQtC", "dateUpdated": "2026-07-23T12:33:11.068Z"}, "title": "XML injection vulnerability in QDom comment, CDATA and processing-instruction serialization", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-91", "description": "CWE-91 XML injection (aka blind XPath injection)", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-250", "descriptions": [{"lang": "en", "value": "CAPEC-250 XML Injection"}]}], "affected": [{"vendor": "Qt", "product": "Qt", "modules": ["qtbase"], "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "6.12.0", "versionType": "python"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0.0", "versionEndExcluding": "6.12.0"}]}]}], "descriptions": [{"lang": "en", "value": "Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.<br>"}]}], "references": [{"url": "https://codereview.qt-project.org/c/qt/qtbase/+/748323", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "LOW", "baseScore": 2.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}], "workarounds": [{"lang": "en", "value": "On all affected versions, set the invalid-data policy before building documents:QDomImplementation::setInvalidDataPolicy(QDomImplementation::ReturnNullNode);\u00a0(or\u00a0DropInvalidChars). With\u00a0ReturnNullNode, the QDom factory functions return a null node when given data that is invalid per XML 1.0 \u2014 check the return value. As additional defence-in-depth, validate untrusted input before inserting it and do not treat QDom output as trusted structure downstream.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "On all affected versions, set the invalid-data policy before building documents:<code>QDomImplementation::setInvalidDataPolicy(QDomImplementation::ReturnNullNode);</code> (or <code>DropInvalidChars</code>). With <code>ReturnNullNode</code>, the QDom factory functions return a null node when given data that is invalid per XML 1.0 \u2014 check the return value. As additional defence-in-depth, validate untrusted input before inserting it and do not treat QDom output as trusted structure downstream."}]}], "solutions": [{"lang": "en", "value": "Update to Qt 6.12 or later.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Update to Qt 6.12 or later."}]}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-23T14:45:32.322294Z", "id": "CVE-2026-15037", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-23T14:45:39.734Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15037", "assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "state": "PUBLISHED", "assignerShortName": "TQtC", "dateReserved": "2026-07-08T08:35:17.940Z", "datePublished": "2026-07-23T12:33:11.068Z", "dateUpdated": "2026-07-23T14:45:39.734Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "shortName": "TQtC", "dateUpdated": "2026-07-23T12:33:11.068Z"}, "title": "XML injection vulnerability in QDom comment, CDATA and processing-instruction serialization", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-91", "description": "CWE-91 XML injection (aka blind XPath injection)", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-250", "descriptions": [{"lang": "en", "value": "CAPEC-250 XML Injection"}]}], "affected": [{"vendor": "Qt", "product": "Qt", "modules": ["qtbase"], "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "6.12.0", "versionType": "python"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0.0", "versionEndExcluding": "6.12.0"}]}]}], "descriptions": [{"lang": "en", "value": "Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.<br>"}]}], "references": [{"url": "https://codereview.qt-project.org/c/qt/qtbase/+/748323", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "LOW", "baseScore": 2.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}], "workarounds": [{"lang": "en", "value": "On all affected versions, set the invalid-data policy before building documents:QDomImplementation::setInvalidDataPolicy(QDomImplementation::ReturnNullNode);\u00a0(or\u00a0DropInvalidChars). With\u00a0ReturnNullNode, the QDom factory functions return a null node when given data that is invalid per XML 1.0 \u2014 check the return value. As additional defence-in-depth, validate untrusted input before inserting it and do not treat QDom output as trusted structure downstream.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "On all affected versions, set the invalid-data policy before building documents:<code>QDomImplementation::setInvalidDataPolicy(QDomImplementation::ReturnNullNode);</code> (or <code>DropInvalidChars</code>). With <code>ReturnNullNode</code>, the QDom factory functions return a null node when given data that is invalid per XML 1.0 \u2014 check the return value. As additional defence-in-depth, validate untrusted input before inserting it and do not treat QDom output as trusted structure downstream."}]}], "solutions": [{"lang": "en", "value": "Update to Qt 6.12 or later.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Update to Qt 6.12 or later."}]}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-15037", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-23T14:45:32.322294Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-23T14:45:35.678Z"}}]}}