{"schema_version":"2","view":"grouped","data":[{"id":70972,"cve_ids":["CVE-2026-61586"],"payload":{"kind":"advisory","title":"Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolution","summary":"Copernik XML Factory through `0.1.1`, when running on its stock JDK provider, does not block XInclude resource resolution after an application enables XInclude on a factory returned by `XmlFactories.newDocumentBuilderFactory()` or `XmlFactories.newSAXParserFactory()`, or on an `XMLReader` passed through `XmlFactories.harden()`. The library's documented guarantee that XInclude resolution stays disabled therefore does not hold on that provider. An application that parses untrusted XML in this configuration can be made to resolve `xi:include` references, allowing an attacker to read local files (information disclosure) or, through `http` hrefs, reach internal network endpoints (SSRF). All of the following conditions must hold for an application to be affected: - it obtains a factory from `XmlFactories.newDocumentBuilderFactory()` or `XmlFactories.newSAXParserFactory()`, or hardens an externally obtained `XMLReader` with `XmlFactories.harden()`; - the stock JDK provider is in effect, that is, Apache Xerces is not on the classpath; - XInclude is enabled, by calling `setXIncludeAware(true)` or the equivalent reader feature; - it parses XML from an untrusted source. The Xerces provider (selected when Xerces is on the classpath) and the Android provider are not affected. Applications are advised to upgrade to `0.1.2`, which fixes the defect. As a workaround add Apache Xerces (`xercesImpl`) to the classpath so the library selects its unaffected Xerces provider. ### Acknowledgements Th","evidence":"osv:GHSA-xm28-xvqc-gxxg","products":[{"name":{"value":"eu.copernik:copernik-xml-factory","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.1.2","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"0.1.0","evidence":"/affected/0/versions"},{"value":"0.1.1","evidence":"/affected/0/versions"}]}],"severity":"high","structured":{"id":"GHSA-xm28-xvqc-gxxg","aliases":["CVE-2026-61586","GHSA-xm28-xvqc-gxxg"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2"}]}],"package":{"name":"eu.copernik:copernik-xml-factory","purl":"pkg:maven/eu.copernik/copernik-xml-factory","ecosystem":"Maven"},"versions":["0.1.0","0.1.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-xm28-xvqc-gxxg/GHSA-xm28-xvqc-gxxg.json"}}],"modified":"2026-10-02T18:45:04.985000035Z","provider":"osv","references":["https://github.com/copernik-eu/copernik-xml-factory/security/advisories/GHSA-xm28-xvqc-gxxg","https://github.com/copernik-eu/copernik-xml-factory/commit/2fa042c44931b0a4ddd585d62b97a8a987efd6c6","https://github.com/copernik-eu/copernik-xml-factory/commit/e5febc6039ed4b0088245acb80ed7d6d6a7f5537","https://github.com/copernik-eu/copernik-xml-factory","https://github.com/copernik-eu/copernik-xml-factory/releases/tag/v0.1.2"],"provider_metadata":{"cwe_ids":["CWE-611"],"severity":"HIGH","github_reviewed":true,"nvd_published_at":null,"github_reviewed_at":"2026-10-02T18:27:17Z"}},"related_cves":[{"value":"CVE-2026-61586","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"osv:GHSA-xm28-xvqc-gxxg","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-xm28-xvqc-gxxg","advisory_id":"d3457626-9d15-40df-a5b6-d6e08d1b0482","event_types":["advisory"],"published_at":"2026-10-25T22:45:58.558402+00:00","technologies":["core-osv","eu-copernik-copernik-xml-factory"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T18:27:17+00:00","detail_url":"/advisories/osv%3AGHSA-xm28-xvqc-gxxg","group":{"id":"osv:GHSA-xm28-xvqc-gxxg","revision":1,"primary_event_id":71345,"change":"published","superseded_by":[],"changed":{"id":71345,"cve_ids":["CVE-2026-61586"],"payload":{"kind":"advisory","title":"Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolution","summary":"Copernik XML Factory through `0.1.1`, when running on its stock JDK provider, does not block XInclude resource resolution after an application enables XInclude on a factory returned by `XmlFactories.newDocumentBuilderFactory()` or `XmlFactories.newSAXParserFactory()`, or on an `XMLReader` passed through `XmlFactories.harden()`. The library's documented guarantee that XInclude resolution stays disabled therefore does not hold on that provider. An application that parses untrusted XML in this configuration can be made to resolve `xi:include` references, allowing an attacker to read local files (information disclosure) or, through `http` hrefs, reach internal network endpoints (SSRF). All of the following conditions must hold for an application to be affected: - it obtains a factory from `XmlFactories.newDocumentBuilderFactory()` or `XmlFactories.newSAXParserFactory()`, or hardens an externally obtained `XMLReader` with `XmlFactories.harden()`; - the stock JDK provider is in effect, that is, Apache Xerces is not on the classpath; - XInclude is enabled, by calling `setXIncludeAware(true)` or the equivalent reader feature; - it parses XML from an untrusted source. The Xerces provider (selected when Xerces is on the classpath) and the Android provider are not affected. Applications are advised to upgrade to `0.1.2`, which fixes the defect. As a workaround add Apache Xerces (`xercesImpl`) to the classpath so the library selects its unaffected Xerces provider. ### Acknowledgements Th","evidence":"osv:GHSA-xm28-xvqc-gxxg","products":[{"name":{"value":"eu.copernik:copernik-xml-factory","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.1.2","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"0.1.0","evidence":"/affected/0/versions"},{"value":"0.1.1","evidence":"/affected/0/versions"}]}],"severity":"high","structured":{"id":"GHSA-xm28-xvqc-gxxg","aliases":["CVE-2026-61586","GHSA-xm28-xvqc-gxxg"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2"}]}],"package":{"name":"eu.copernik:copernik-xml-factory","purl":"pkg:maven/eu.copernik/copernik-xml-factory","ecosystem":"Maven"},"versions":["0.1.0","0.1.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-xm28-xvqc-gxxg/GHSA-xm28-xvqc-gxxg.json"}}],"modified":"2026-10-02T18:45:04.985000035Z","provider":"osv","references":["https://github.com/copernik-eu/copernik-xml-factory/security/advisories/GHSA-xm28-xvqc-gxxg","https://github.com/copernik-eu/copernik-xml-factory/commit/2fa042c44931b0a4ddd585d62b97a8a987efd6c6","https://github.com/copernik-eu/copernik-xml-factory/commit/e5febc6039ed4b0088245acb80ed7d6d6a7f5537","https://github.com/copernik-eu/copernik-xml-factory","https://github.com/copernik-eu/copernik-xml-factory/releases/tag/v0.1.2"],"provider_metadata":{"cwe_ids":["CWE-611"],"severity":"HIGH","github_reviewed":true,"nvd_published_at":null,"github_reviewed_at":"2026-10-02T18:27:17Z"}},"related_cves":[{"value":"CVE-2026-61586","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"osv:GHSA-xm28-xvqc-gxxg","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-xm28-xvqc-gxxg","advisory_id":"d3457626-9d15-40df-a5b6-d6e08d1b0482","event_types":["advisory"],"published_at":"2026-10-25T22:45:58.558402+00:00","technologies":["core-osv","eu-copernik-copernik-xml-factory"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T18:27:17+00:00","detail_url":"/events/71345"},"members":[{"id":71345,"cve_ids":["CVE-2026-61586"],"payload":{"kind":"advisory","title":"Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolution","summary":"Copernik XML Factory through `0.1.1`, when running on its stock JDK provider, does not block XInclude resource resolution after an application enables XInclude on a factory returned by `XmlFactories.newDocumentBuilderFactory()` or `XmlFactories.newSAXParserFactory()`, or on an `XMLReader` passed through `XmlFactories.harden()`. The library's documented guarantee that XInclude resolution stays disabled therefore does not hold on that provider. An application that parses untrusted XML in this configuration can be made to resolve `xi:include` references, allowing an attacker to read local files (information disclosure) or, through `http` hrefs, reach internal network endpoints (SSRF). All of the following conditions must hold for an application to be affected: - it obtains a factory from `XmlFactories.newDocumentBuilderFactory()` or `XmlFactories.newSAXParserFactory()`, or hardens an externally obtained `XMLReader` with `XmlFactories.harden()`; - the stock JDK provider is in effect, that is, Apache Xerces is not on the classpath; - XInclude is enabled, by calling `setXIncludeAware(true)` or the equivalent reader feature; - it parses XML from an untrusted source. The Xerces provider (selected when Xerces is on the classpath) and the Android provider are not affected. Applications are advised to upgrade to `0.1.2`, which fixes the defect. As a workaround add Apache Xerces (`xercesImpl`) to the classpath so the library selects its unaffected Xerces provider. ### Acknowledgements Th","evidence":"osv:GHSA-xm28-xvqc-gxxg","products":[{"name":{"value":"eu.copernik:copernik-xml-factory","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.1.2","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"0.1.0","evidence":"/affected/0/versions"},{"value":"0.1.1","evidence":"/affected/0/versions"}]}],"severity":"high","structured":{"id":"GHSA-xm28-xvqc-gxxg","aliases":["CVE-2026-61586","GHSA-xm28-xvqc-gxxg"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.2"}]}],"package":{"name":"eu.copernik:copernik-xml-factory","purl":"pkg:maven/eu.copernik/copernik-xml-factory","ecosystem":"Maven"},"versions":["0.1.0","0.1.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-xm28-xvqc-gxxg/GHSA-xm28-xvqc-gxxg.json"}}],"modified":"2026-10-02T18:45:04.985000035Z","provider":"osv","references":["https://github.com/copernik-eu/copernik-xml-factory/security/advisories/GHSA-xm28-xvqc-gxxg","https://github.com/copernik-eu/copernik-xml-factory/commit/2fa042c44931b0a4ddd585d62b97a8a987efd6c6","https://github.com/copernik-eu/copernik-xml-factory/commit/e5febc6039ed4b0088245acb80ed7d6d6a7f5537","https://github.com/copernik-eu/copernik-xml-factory","https://github.com/copernik-eu/copernik-xml-factory/releases/tag/v0.1.2"],"provider_metadata":{"cwe_ids":["CWE-611"],"severity":"HIGH","github_reviewed":true,"nvd_published_at":null,"github_reviewed_at":"2026-10-02T18:27:17Z"}},"related_cves":[{"value":"CVE-2026-61586","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"osv:GHSA-xm28-xvqc-gxxg","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-xm28-xvqc-gxxg","advisory_id":"d3457626-9d15-40df-a5b6-d6e08d1b0482","event_types":["advisory"],"published_at":"2026-10-25T22:45:58.558402+00:00","technologies":["core-osv","eu-copernik-copernik-xml-factory"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-02T18:27:17+00:00","detail_url":"/events/71345"}]}}],"next_after":70972,"next_before":70972}