{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15037", "assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "state": "PUBLISHED", "assignerShortName": "TQtC", "dateReserved": "2026-07-08T08:35:17.940Z", "datePublished": "2026-07-23T12:33:11.068Z", "dateUpdated": "2026-07-23T14:45:39.734Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3", "shortName": "TQtC", "dateUpdated": "2026-07-23T12:33:11.068Z"}, "title": "XML injection vulnerability in QDom comment, CDATA and processing-instruction serialization", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-91", "description": "CWE-91 XML injection (aka blind XPath injection)", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-250", "descriptions": [{"lang": "en", "value": "CAPEC-250 XML Injection"}]}], "affected": [{"vendor": "Qt", "product": "Qt", "modules": ["qtbase"], "versions": [{"status": "affected", "version": "4.0.0", "lessThan": "6.12.0", "versionType": "python"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:qt:qt:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.0.0", "versionEndExcluding": "6.12.0"}]}]}], "descriptions": [{"lang": "en", "value": "Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.<br>"}]}], "references": [{"url": "https://codereview.qt-project.org/c/qt/qtbase/+/748323", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "LOW", "baseScore": 2.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}], "workarounds": [{"lang": "en", "value": "On all affected versions, set the invalid-data policy before building documents:QDomImplementation::setInvalidDataPolicy(QDomImplementation::ReturnNullNode);\u00a0(or\u00a0DropInvalidChars). With\u00a0ReturnNullNode, the QDom factory functions return a null node when given data that is invalid per XML 1.0 \u2014 check the return value. As additional defence-in-depth, validate untrusted input before inserting it and do not treat QDom output as trusted structure downstream.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "On all affected versions, set the invalid-data policy before building documents:<code>QDomImplementation::setInvalidDataPolicy(QDomImplementation::ReturnNullNode);</code>&nbsp;(or&nbsp;<code>DropInvalidChars</code>). With&nbsp;<code>ReturnNullNode</code>, the QDom factory functions return a null node when given data that is invalid per XML 1.0 \u2014 check the return value. As additional defence-in-depth, validate untrusted input before inserting it and do not treat QDom output as trusted structure downstream."}]}], "solutions": [{"lang": "en", "value": "Update to Qt 6.12 or later.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Update to Qt 6.12 or later."}]}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-23T14:45:32.322294Z", "id": "CVE-2026-15037", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-23T14:45:39.734Z"}}]}}

{}

{}

{}

{}