CVE-2018-1000840
Processing Foundation Processing version 3.4 and earlier contains a XML External Entity (XXE)...
Processing Foundation Processing version 3.4 and earlier contains a XML External Entity (XXE) vulnerability in loadXML() function that can result in An attacker can read arbitrary files and exfiltrate their contents via HTTP requests. This attack appear to be exploitable via The victim must use Processing to parse a crafted XML document.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Processing Foundation Processing version 3.4 and earlier contains a XML External Entity (XXE) vulnerability in loadXML() function that can result in An attacker can read arbitrary files and exfiltrate their contents via HTTP requests. This attack appear to be exploitable via The victim must use Processing to parse a crafted XML document.
- Record
CVE-2018-1000840- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
CVE List No score
Processing Foundation Processing version 3.4 and earlier contains a XML External Entity (XXE) vulnerability in loadXML() function that can result in An attacker can read arbitrary files and exfiltrate their contents via HTTP requests. This attack appear to be exploitable via The victim must use Processing to parse a crafted XML document.
- Record
CVE-2018-1000840- Updated
- 2026-11-02
EUVDEUVD-2018-2031 No score
Processing Foundation Processing version 3.4 and earlier contains a XML External Entity (XXE) vulnerability in loadXML() function that can result in An attacker can read arbitrary files and exfiltrate their contents via HTTP requests. This attack appear to be exploitable via The victim must use Processing to parse a crafted XML document.
- Record
EUVD-2018-2031- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6c4g-2qw2-mffh
Processing Foundation Processing version 3.4 and earlier contains a XML External Entity (XXE)...
Processing Foundation Processing version 3.4 and earlier contains a XML External Entity (XXE) vulnerability in loadXML() function that can result in An attacker can read arbitrary files and exfiltrate their contents via HTTP requests. This attack appear to be exploitable via The victim must use Processing to parse a crafted XML document.
- Record
GHSA-6c4g-2qw2-mffh- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-1000840
Processing Foundation Processing version 3.4 and earlier contains a XML External Entity (XXE) vulnerability in loadXML() function that can result in An attacker can read arbitrary files and exfiltrate their contents via HTTP requests. This attack appear to be exploitable via The victim must use Processing to parse a crafted XML document.
- Record
UBUNTU-CVE-2018-1000840- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
processing-coreUbuntu:16.04:LTS |
All versions, plus listed versions 1.2.1-1 |
None known |
processing-coreUbuntu:18.04:LTS |
All versions, plus listed versions 1.2.1-11.2.1-2 |
None known |
processing-coreUbuntu:20.04:LTS |
All versions, plus listed versions 1.2.1-2 |
None known |
processing-coreUbuntu:22.04:LTS |
All versions, plus listed versions 1.2.1-2 |
None known |
processing-coreUbuntu:24.04:LTS |
All versions, plus listed versions 1.2.1-2 |
None known |
processing-coreUbuntu:25.10 |
All versions, plus listed versions 1.2.1-3 |
None known |
processing-coreUbuntu:26.10 |
All versions, plus listed versions 1.2.1-3build1 |
None known |
processing-coreUbuntu:26.04:LTS |
All versions, plus listed versions 1.2.1-31.2.1-3build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-1000840 is a medium vulnerability (CVSS 6.5) in Processing, published December 20, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.18%, the 82nd percentile. No source names a fixed version.