GHSA-xm28-xvqc-gxxg

Suggest an improvement
Source
https://github.com/advisories/GHSA-xm28-xvqc-gxxg
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-xm28-xvqc-gxxg/GHSA-xm28-xvqc-gxxg.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-xm28-xvqc-gxxg
Aliases
  • CVE-2026-61586
Published
2026-10-02T18:27:17Z
Modified
2026-10-02T18:45:09Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolution
Details

Copernik XML Factory through 0.1.1, when running on its stock JDK provider, does not block XInclude resource resolution after an application enables XInclude on a factory returned by XmlFactories.newDocumentBuilderFactory() or XmlFactories.newSAXParserFactory(), or on an XMLReader passed through XmlFactories.harden(). The library's documented guarantee that XInclude resolution stays disabled therefore does not hold on that provider.

An application that parses untrusted XML in this configuration can be made to resolve xi:include references, allowing an attacker to read local files (information disclosure) or, through http hrefs, reach internal network endpoints (SSRF).

All of the following conditions must hold for an application to be affected:

  • it obtains a factory from XmlFactories.newDocumentBuilderFactory() or XmlFactories.newSAXParserFactory(), or hardens an externally obtained XMLReader with XmlFactories.harden();
  • the stock JDK provider is in effect, that is, Apache Xerces is not on the classpath;
  • XInclude is enabled, by calling setXIncludeAware(true) or the equivalent reader feature;
  • it parses XML from an untrusted source.

The Xerces provider (selected when Xerces is on the classpath) and the Android provider are not affected.

Applications are advised to upgrade to 0.1.2, which fixes the defect. As a workaround add Apache Xerces (xercesImpl) to the classpath so the library selects its unaffected Xerces provider.

Acknowledgements

The maintainer thank the following people for finding, reporting, and helping to remediate this issue:

  • Finders: Ta Duc Thien and Duc Anh Nguyen (Danzation)
  • Remediation developer: Ta Duc Thien
  • Tooling: Claude Code (Anthropic), Claude Opus 4.8
Database specific 
{
    "cwe_ids": [
        "CWE-611"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-02T18:27:17Z",
    "nvd_published_at": null,
    "severity": "HIGH"
}
References

Affected packages

Maven / eu.copernik:copernik-xml-factory

Package

Name
eu.copernik:copernik-xml-factory
View open source insights on deps.dev
Purl
pkg:maven/eu.copernik/copernik-xml-factory

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.1.2

Affected versions

0.*
0.1.0
0.1.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-xm28-xvqc-gxxg/GHSA-xm28-xvqc-gxxg.json"