{"id":"CVE-2026-6807","aliases":["EUVD-2026-26135","GHSA-w2pw-52qg-478g"],"status":"published","title":"NSA GRASSMARLIN Improper Restriction of XML External Entity Reference","description":"A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to \ntrigger improper handling of XML input, which may result in unintended \nexposure of sensitive information. The flaw stems from insufficient \nhardening of the XML parsing process.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00197,"percentile":0.09543,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-611"],"published":"2026-04-28T17:41:13Z","modified":"2026-10-26T20:10:00Z","exploits":[{"source":"pocgithub","id":"SecTestAnnaQuinn/Grassmarlin-CVE-2026-6807-XXE-POC","title":"SecTestAnnaQuinn/Grassmarlin-CVE-2026-6807-XXE-POC","date":"2026-04-28","url":"https://github.com/SecTestAnnaQuinn/Grassmarlin-CVE-2026-6807-XXE-POC"}],"products":[{"vendor":"nsa","product":"grassmarlin"}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-26-118-01"},{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-118-01.json"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6807"},{"url":"https://github.com/advisories/GHSA-w2pw-52qg-478g"}],"sources":{"cve":[{"id":"CVE-2026-6807","title":"NSA GRASSMARLIN Improper Restriction of XML External Entity Reference","description":"A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to \ntrigger improper handling of XML input, which may result in unintended \nexposure of sensitive information. The flaw stems from insufficient \nhardening of the XML parsing process.","status":"published","published":"2026-04-28T17:41:13.48Z","modified":"2026-04-29T15:12:21.569Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T13:50:04.986624Z"}],"euvd":[{"id":"EUVD-2026-26135","description":"A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to \ntrigger improper handling of XML input, which may result in unintended \nexposure of sensitive information. The flaw stems from insufficient \nhardening of the XML parsing process.","status":"published","published":"2026-04-28T17:41:13Z","modified":"2026-04-29T15:12:21Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:05:19.555165Z"}],"ghsa":[{"id":"GHSA-w2pw-52qg-478g","title":"A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to \ntrigger improper handling...","description":"A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to \ntrigger improper handling of XML input, which may result in unintended \nexposure of sensitive information. The flaw stems from insufficient \nhardening of the XML parsing process.","status":"published","published":"2026-04-28T21:36:14Z","modified":"2026-04-28T21:36:26Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:07:50.524404Z"}],"nvd":[{"id":"CVE-2026-6807","description":"A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to \ntrigger improper handling of XML input, which may result in unintended \nexposure of sensitive information. The flaw stems from insufficient \nhardening of the XML parsing process.","status":"published","published":"2026-04-28T19:37:47.773Z","modified":"2026-10-26T20:10:00.16Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:12:16.252509Z"}]}}