CVE-2026-15037
XML injection vulnerability in QDom comment, CDATA and processing-instruction serialization
Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
XML injection vulnerability in QDom comment, CDATA and processing-instruction serialization
Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.
- Record
CVE-2026-15037- CVSS 4.0
- 2.9 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-91
- Updated
- 2026-11-02
EUVDEUVD-2026-48254
Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.
- Record
EUVD-2026-48254- CVSS 4.0
- 2.9 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7xx4-xq65-r6v3
Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction...
Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.
- Record
GHSA-7xx4-xq65-r6v3- CVSS 4.0
- 2.9 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-91
- Updated
- 2026-11-02
NVD
Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.
- Record
CVE-2026-15037- CVSS 4.0
- 2.9 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-91
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-15037
Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.
- Record
DEBIAN-CVE-2026-15037- CVSS 4.0
- 2.9 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVRHSA-2026:82382
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:82382- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-15037
Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.
- Record
UBUNTU-CVE-2026-15037- CVSS 4.0
- 2.9 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P - Updated
- 2026-11-02
OSVAZL-94116 No score
CVE-2026-15037 affecting package qtbase for versions less than 6.6.3-5
Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.
- Record
AZL-94116- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qtbaseAzure Linux:3 |
before 6.6.3-5 | 6.6.3-5 |
qt6-baseDebian:12 |
All versions, plus listed versions 6.10.2+dfsg-16.10.2+dfsg-106.10.2+dfsg-10+hurd.16.10.2+dfsg-116.10.2+dfsg-12 Show 45 moreShow less6.10.2+dfsg-136.10.2+dfsg-146.10.2+dfsg-156.10.2+dfsg-166.10.2+dfsg-26.10.2+dfsg-36.10.2+dfsg-46.10.2+dfsg-56.10.2+dfsg-66.10.2+dfsg-76.10.2+dfsg-7+hurd.16.10.2+dfsg-86.10.2+dfsg-96.11.2+dfsg-16.11.2+dfsg-26.11.2+dfsg-36.11.2+dfsg-46.11.2+dfsg-56.11.2+dfsg-5+sparc646.11.2+dfsg-66.11.2+dfsg-76.4.2+dfsg-106.4.2+dfsg-116.4.2+dfsg-11~bpo11+16.4.2+dfsg-126.4.2+dfsg-136.4.2+dfsg-146.4.2+dfsg-156.4.2+dfsg-166.4.2+dfsg-176.4.2+dfsg-186.4.2+dfsg-18+loong646.4.2+dfsg-196.4.2+dfsg-206.4.2+dfsg-216.4.2+dfsg-21.16.6.0+dfsg-16.6.0+dfsg-26.6.0+dfsg-36.6.0+dfsg-46.6.0+dfsg-56.6.0+dfsg-66.6.1+dfsg-16.6.1+dfsg-26.6.1+dfsg-3 |
None known |
qt6-baseDebian:13 |
All versions, plus listed versions 6.10.2+dfsg-16.10.2+dfsg-106.10.2+dfsg-10+hurd.16.10.2+dfsg-116.10.2+dfsg-12 Show 35 moreShow less6.10.2+dfsg-136.10.2+dfsg-146.10.2+dfsg-156.10.2+dfsg-166.10.2+dfsg-26.10.2+dfsg-36.10.2+dfsg-46.10.2+dfsg-56.10.2+dfsg-66.10.2+dfsg-76.10.2+dfsg-7+hurd.16.10.2+dfsg-86.10.2+dfsg-96.11.2+dfsg-16.11.2+dfsg-26.11.2+dfsg-36.11.2+dfsg-46.11.2+dfsg-56.11.2+dfsg-5+sparc646.11.2+dfsg-66.11.2+dfsg-76.8.2+dfsg-106.8.2+dfsg-10.16.8.2+dfsg-96.8.2+dfsg-9+deb13u16.8.2+dfsg-9+deb13u26.9.1+dfsg-16.9.1+dfsg-26.9.1+dfsg-36.9.1+dfsg-46.9.1+dfsg-56.9.2+dfsg-16.9.2+dfsg-26.9.2+dfsg-36.9.2+dfsg-4 |
None known |
qt6-baseDebian:14 |
before 6.11.2+dfsg-6, plus listed versions 6.10.2+dfsg-16.10.2+dfsg-106.10.2+dfsg-10+hurd.16.10.2+dfsg-116.10.2+dfsg-12 Show 31 moreShow less6.10.2+dfsg-136.10.2+dfsg-146.10.2+dfsg-156.10.2+dfsg-166.10.2+dfsg-26.10.2+dfsg-36.10.2+dfsg-46.10.2+dfsg-56.10.2+dfsg-66.10.2+dfsg-76.10.2+dfsg-7+hurd.16.10.2+dfsg-86.10.2+dfsg-96.11.2+dfsg-16.11.2+dfsg-26.11.2+dfsg-36.11.2+dfsg-46.11.2+dfsg-56.11.2+dfsg-5+sparc646.8.2+dfsg-106.8.2+dfsg-10.16.8.2+dfsg-96.9.1+dfsg-16.9.1+dfsg-26.9.1+dfsg-36.9.1+dfsg-46.9.1+dfsg-56.9.2+dfsg-16.9.2+dfsg-26.9.2+dfsg-36.9.2+dfsg-4 |
6.11.2+dfsg-6 |
qtbase-opensource-srcDebian:12 |
All versions, plus listed versions 5.15.10+dfsg-15.15.10+dfsg-25.15.10+dfsg-35.15.10+dfsg-45.15.10+dfsg-5 Show 45 moreShow less5.15.10+dfsg-65.15.10+dfsg-75.15.10+dfsg-7.15.15.10+dfsg-7.25.15.11+dfsg-15.15.12+dfsg-15.15.12+dfsg-25.15.12+dfsg-35.15.13+dfsg-15.15.13+dfsg-25.15.13+dfsg-35.15.13+dfsg-45.15.14+dfsg-15.15.15+dfsg-15.15.15+dfsg-25.15.15+dfsg-35.15.15+dfsg-45.15.15+dfsg-55.15.15+dfsg-65.15.16+dfsg-15.15.16+dfsg-25.15.17+dfsg-15.15.17+dfsg-25.15.17+dfsg-35.15.17+dfsg-45.15.17+dfsg-55.15.17+dfsg-65.15.17+dfsg-75.15.17+dfsg-85.15.18+dfsg-15.15.18+dfsg-25.15.19+dfsg-15.15.19+dfsg-25.15.19+dfsg-35.15.19+dfsg-45.15.19+dfsg-55.15.19+dfsg-65.15.8+dfsg-115.15.8+dfsg-11+deb12u15.15.8+dfsg-11+deb12u25.15.8+dfsg-11+deb12u35.15.8+dfsg-125.15.8+dfsg-135.15.9+dfsg-15.15.9+dfsg-2 |
None known |
qtbase-opensource-srcDebian:13 |
All versions, plus listed versions 5.15.15+dfsg-65.15.15+dfsg-6+deb13u15.15.16+dfsg-15.15.16+dfsg-25.15.17+dfsg-1 Show 15 moreShow less5.15.17+dfsg-25.15.17+dfsg-35.15.17+dfsg-45.15.17+dfsg-55.15.17+dfsg-65.15.17+dfsg-75.15.17+dfsg-85.15.18+dfsg-15.15.18+dfsg-25.15.19+dfsg-15.15.19+dfsg-25.15.19+dfsg-35.15.19+dfsg-45.15.19+dfsg-55.15.19+dfsg-6 |
None known |
qtbase-opensource-srcDebian:14 |
All versions, plus listed versions 5.15.15+dfsg-65.15.16+dfsg-15.15.16+dfsg-25.15.17+dfsg-15.15.17+dfsg-2 Show 14 moreShow less5.15.17+dfsg-35.15.17+dfsg-45.15.17+dfsg-55.15.17+dfsg-65.15.17+dfsg-75.15.17+dfsg-85.15.18+dfsg-15.15.18+dfsg-25.15.19+dfsg-15.15.19+dfsg-25.15.19+dfsg-35.15.19+dfsg-45.15.19+dfsg-55.15.19+dfsg-6 |
None known |
qt6-qtbaseRed Hat:hummingbird:1 |
before 0:6.11.2-3.1.hum1 | 0:6.11.2-3.1.hum1 |
qt6-qtbase-commonRed Hat:hummingbird:1 |
before 0:6.11.2-3.1.hum1 | 0:6.11.2-3.1.hum1 |
qt6-qtbase-develRed Hat:hummingbird:1 |
before 0:6.11.2-3.1.hum1 | 0:6.11.2-3.1.hum1 |
Show 22 moreShow less
| Package | Affected | Fixed |
|---|---|---|
qt6-qtbase-examplesRed Hat:hummingbird:1 |
before 0:6.11.2-3.1.hum1 | 0:6.11.2-3.1.hum1 |
qt6-qtbase-guiRed Hat:hummingbird:1 |
before 0:6.11.2-3.1.hum1 | 0:6.11.2-3.1.hum1 |
qt6-qtbase-ibaseRed Hat:hummingbird:1 |
before 0:6.11.2-3.1.hum1 | 0:6.11.2-3.1.hum1 |
qt6-qtbase-mysqlRed Hat:hummingbird:1 |
before 0:6.11.2-3.1.hum1 | 0:6.11.2-3.1.hum1 |
qt6-qtbase-odbcRed Hat:hummingbird:1 |
before 0:6.11.2-3.1.hum1 | 0:6.11.2-3.1.hum1 |
qt6-qtbase-postgresqlRed Hat:hummingbird:1 |
before 0:6.11.2-3.1.hum1 | 0:6.11.2-3.1.hum1 |
qt6-qtbase-private-develRed Hat:hummingbird:1 |
before 0:6.11.2-3.1.hum1 | 0:6.11.2-3.1.hum1 |
qt6-qtbase-staticRed Hat:hummingbird:1 |
before 0:6.11.2-3.1.hum1 | 0:6.11.2-3.1.hum1 |
qt4-x11Ubuntu:14.04:LTS |
All versions, plus listed versions 4:4.8.4+dfsg-0ubuntu184:4.8.4+dfsg-0ubuntu194:4.8.4+dfsg-0ubuntu204:4.8.4+dfsg-0ubuntu214:4.8.4+dfsg-0ubuntu224:4.8.5+git192-g085f851+dfsg-2ubuntu34:4.8.5+git192-g085f851+dfsg-2ubuntu44:4.8.5+git192-g085f851+dfsg-2ubuntu4.1 |
None known |
qt4-x11Ubuntu:16.04:LTS |
All versions, plus listed versions 4:4.8.6+git64-g5dc8b2b+dfsg-3~ubuntu84:4.8.7+dfsg-5ubuntu14:4.8.7+dfsg-5ubuntu2 |
None known |
qtbase-opensource-srcUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 5.4.2+dfsg-2ubuntu95.5.1+dfsg-6ubuntu45.5.1+dfsg-10ubuntu25.5.1+dfsg-13ubuntu15.5.1+dfsg-13ubuntu2 Show 15 moreShow less5.5.1+dfsg-13ubuntu35.5.1+dfsg-14ubuntu15.5.1+dfsg-14ubuntu25.5.1+dfsg-14ubuntu35.5.1+dfsg-15ubuntu15.5.1+dfsg-16ubuntu15.5.1+dfsg-16ubuntu65.5.1+dfsg-16ubuntu75.5.1+dfsg-16ubuntu7.15.5.1+dfsg-16ubuntu7.25.5.1+dfsg-16ubuntu7.55.5.1+dfsg-16ubuntu7.65.5.1+dfsg-16ubuntu7.75.5.1+dfsg-16ubuntu7.7+esm15.5.1+dfsg-16ubuntu7.7+esm2 |
None known |
qtbase-opensource-srcUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 5.9.1+dfsg-10ubuntu15.9.1+dfsg-10ubuntu25.9.2+dfsg-4ubuntu65.9.3+dfsg-0ubuntu15.9.3+dfsg-0ubuntu3 Show 12 moreShow less5.9.3+dfsg-0ubuntu45.9.4+dfsg-0ubuntu35.9.4+dfsg-0ubuntu45.9.5+dfsg-0ubuntu15.9.5+dfsg-0ubuntu25.9.5+dfsg-0ubuntu2.15.9.5+dfsg-0ubuntu2.35.9.5+dfsg-0ubuntu2.45.9.5+dfsg-0ubuntu2.55.9.5+dfsg-0ubuntu2.65.9.5+dfsg-0ubuntu2.6+esm15.9.5+dfsg-0ubuntu2.6+esm2 |
None known |
qt4-x11Ubuntu:18.04:LTS |
All versions, plus listed versions 4:4.8.7+dfsg-7ubuntu1 |
None known |
qtbase-opensource-srcUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 5.12.4+dfsg-4ubuntu15.12.5+dfsg-25.12.5+dfsg-85.12.5+dfsg-8build15.12.5+dfsg-9build1 Show 6 moreShow less5.12.8+dfsg-0ubuntu15.12.8+dfsg-0ubuntu2.15.12.8+dfsg-0ubuntu2.1+esm15.12.8+dfsg-0ubuntu2.1+esm25.12.8+dfsg-0ubuntu2.1+esm35.12.8+dfsg-0ubuntu2.1+esm4 |
None known |
qt6-baseUbuntu:22.04:LTS |
All versions, plus listed versions 6.2.2+dfsg-5ubuntu16.2.2+dfsg-6ubuntu16.2.2+dfsg-6ubuntu26.2.4+dfsg-1ubuntu16.2.4+dfsg-2ubuntu16.2.4+dfsg-2ubuntu1.1 |
None known |
qtbase-opensource-srcUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 5.15.2+dfsg-125.15.2+dfsg-135.15.2+dfsg-145.15.2+dfsg-14ubuntu15.15.2+dfsg-14ubuntu3 Show 8 moreShow less5.15.2+dfsg-155.15.3+dfsg-15.15.3+dfsg-25.15.3+dfsg-2ubuntu0.15.15.3+dfsg-2ubuntu0.25.15.3+dfsg-2ubuntu0.2+esm15.15.3+dfsg-2ubuntu0.2+esm25.15.3+dfsg-2ubuntu0.2+esm3 |
None known |
qt6-baseUbuntu:24.04:LTS |
All versions, plus listed versions 6.4.2+dfsg-186.4.2+dfsg-196.4.2+dfsg-19build16.4.2+dfsg-206.4.2+dfsg-216.4.2+dfsg-21.1build46.4.2+dfsg-21.1build5 |
None known |
qtbase-opensource-srcUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 5.15.10+dfsg-35.15.10+dfsg-55.15.10+dfsg-5ubuntu15.15.12+dfsg-1ubuntu15.15.12+dfsg-3ubuntu1 Show 4 moreShow less5.15.12+dfsg-3ubuntu65.15.12+dfsg-3ubuntu75.15.13+dfsg-1ubuntu15.15.13+dfsg-1ubuntu1+esm1 |
None known |
qt6-baseUbuntu:26.10 |
All versions, plus listed versions 6.10.2+dfsg-76.10.2+dfsg-14ubuntu26.10.2+dfsg-156.10.2+dfsg-166.11.2+dfsg-4ubuntu2 |
None known |
qtbase-opensource-srcUbuntu:26.10 |
All versions, plus listed versions 5.15.18+dfsg-1ubuntu15.15.19+dfsg-2ubuntu15.15.19+dfsg-2ubuntu2 |
None known |
qt6-baseUbuntu:26.04:LTS |
All versions, plus listed versions 6.9.2+dfsg-1ubuntu16.9.2+dfsg-26.9.2+dfsg-3ubuntu16.9.2+dfsg-3ubuntu26.9.2+dfsg-46.10.2+dfsg-36.10.2+dfsg-66.10.2+dfsg-7 |
None known |
qtbase-opensource-srcUbuntu:26.04:LTS |
All versions, plus listed versions 5.15.17+dfsg-1ubuntu15.15.17+dfsg-1ubuntu25.15.18+dfsg-1ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-15037 is a low vulnerability (CVSS 2.9) in Qt, published July 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in qtbase 6.6.3-5.
References
Left out here: 44 versions. The JSON record has them.