CVE-2026-15037CWE-91

XML injection vulnerability in QDom comment, CDATA and processing-instruction serialization

Low · published July 23, 2026

CVSS v4.0
2.9
EPSS
0%
Percentile
37.6
In the wild
Unconfirmed
What it is

Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.

The record
Technical detail
CVSS v4.0
2.9 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00444 · 37.6th percentile
Weakness
CWE-91 · XML Injection (aka Blind XPath Injection)
Published
2026-07-23T12:33Z
EPSS history
Timeline
  • 23 JUL 12:33Z
    XML injection vulnerability in QDom comment, CDATA and processing-instruction serialization
    cvelistv5