{"schema":"threatline.record/2","record":{"id":"CVE-2026-61586","aliases":["GHSA-xm28-xvqc-gxxg"],"summary":"Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolution","details":"Copernik XML Factory through `0.1.1`, when running on its stock JDK provider, does not block XInclude resource resolution after an application enables XInclude on a factory returned by `XmlFactories.newDocumentBuilderFactory()` or `XmlFactories.newSAXParserFactory()`, or on an `XMLReader` passed through `XmlFactories.harden()`. The library's documented guarantee that XInclude resolution stays disabled therefore does not hold on that provider.\n\nAn application that parses untrusted XML in this configuration can be made to resolve `xi:include` references, allowing an attacker to read local files (information disclosure) or, through `http` hrefs, reach internal network endpoints (SSRF).\n\nAll of the following conditions must hold for an application to be affected:\n- it obtains a factory from `XmlFactories.newDocumentBuilderFactory()` or `XmlFactories.newSAXParserFactory()`, or hardens an externally obtained `XMLReader` with `XmlFactories.harden()`;\n- the stock JDK provider is in effect, that is, Apache Xerces is not on the classpath;\n- XInclude is enabled, by calling `setXIncludeAware(true)` or the equivalent reader feature;\n- it parses XML from an untrusted source.\n\nThe Xerces provider (selected when Xerces is on the classpath) and the Android provider are not affected.\n\nApplications are advised to upgrade to `0.1.2`, which fixes the defect. As a workaround add Apache Xerces (`xercesImpl`) to the classpath so the library selects its unaffected Xerces provider.\n\n### Acknowledgements\n\nThe maintainer thank the following people for finding, reporting, and helping to remediate this issue:\n\n- Finders: Ta Duc Thien and Duc Anh Nguyen (Danzation)\n- Remediation developer: Ta Duc Thien\n- Tooling: Claude Code (Anthropic), Claude Opus 4.8","categories":["Libraries & packages"],"product":"eu.copernik:copernik-xml-factory","vendor":"","ecosystem":"maven","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-xm28-xvqc-gxxg","source_modified_at":"2026-10-02T18:27:20Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"eu.copernik:copernik-xml-factory"},"range":"< 0.1.2"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-xm28-xvqc-gxxg","source_modified_at":"2026-10-02T18:45:04.985000035Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"eu.copernik:copernik-xml-factory","ecosystem":"Maven","purl":"pkg:maven/eu.copernik/copernik-xml-factory"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2"}]}],"versions":["0.1.0","0.1.1"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-xm28-xvqc-gxxg","source_modified_at":"2026-10-02T18:27:20Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"eu.copernik:copernik-xml-factory"},"version":"0.1.2"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-xm28-xvqc-gxxg","source_modified_at":"2026-10-02T18:45:04.985000035Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"eu.copernik:copernik-xml-factory","ecosystem":"Maven","purl":"pkg:maven/eu.copernik/copernik-xml-factory"},"version":"0.1.2"}],"cvss":8.2,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-02T18:27:17Z","modified_at":"2026-10-02T18:45:04.985000035Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-xm28-xvqc-gxxg","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-02T18:27:20Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-xm28-xvqc-gxxg","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-02T18:45:04.985000035Z"}],"sources":["GitHub Advisory Database","OSV"],"references":[{"url":"https://github.com/copernik-eu/copernik-xml-factory/security/advisories/GHSA-xm28-xvqc-gxxg","source":"GitHub Advisory Database"},{"url":"https://github.com/copernik-eu/copernik-xml-factory/commit/2fa042c44931b0a4ddd585d62b97a8a987efd6c6","source":"GitHub Advisory Database"},{"url":"https://github.com/copernik-eu/copernik-xml-factory/commit/e5febc6039ed4b0088245acb80ed7d6d6a7f5537","source":"GitHub Advisory Database"},{"url":"https://github.com/copernik-eu/copernik-xml-factory/releases/tag/v0.1.2","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-xm28-xvqc-gxxg","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-02T18:45:04.985000035Z","content_hash":"02cca085e5e1d1877dec47829d024112b359f30441efab82c3e14d1ad7168abb"}}