VectorFreed

VectorFreed Abstract This document introduces "VectorFreed", a vulnerability chain that begins with a use-after-free I @rafabd1 found in librsvg CVE-2026-96889. In a Node.js/Sharp/libvips build, this bug led to command execution. It covers the bug, the paths confirmed in applications so far, and...

CVE-2026-61586

Copernik XML Factory provides secure-by-default JAXP factory creation for Java. Prior to 0.1.2, Copernik XML Factory does not block XInclude resource resolution on the stock JDK provider after an application enables XInclude on a factory returned by XmlFactories.newDocumentBuilderFactory or...

CVE-2026-61586 Copernik XML Factory: Improper restriction of XInclude resource resolution in Copernik XML Factory (stock JDK provider)

Copernik XML Factory provides secure-by-default JAXP factory creation for Java. Prior to 0.1.2, Copernik XML Factory does not block XInclude resource resolution on the stock JDK provider after an application enables XInclude on a factory returned by XmlFactories.newDocumentBuilderFactory or...

CVE-2026-61586

Prior to version 0.1.2 , Copernik XML Factory fails to block XInclude resource resolution when using the stock JDK provider. If an application enables XInclude on a factory returned by XmlFactories.newDocumentBuilderFactory(), XmlFactories.newSAXParserFactory(), or via XmlFactories.harden(), pars...

CVE-2026-61586 Copernik XML Factory: Improper restriction of XInclude resource resolution in Copernik XML Factory (stock JDK provider)

Copernik XML Factory provides secure-by-default JAXP factory creation for Java. Prior to 0.1.2, Copernik XML Factory does not block XInclude resource resolution on the stock JDK provider after an application enables XInclude on a factory returned by XmlFactories.newDocumentBuilderFactory or...

CVE-2026-61586: copernik-eu copernik-xml-factory: Copernik XML Factory provides secure-by-default JAXP factory creation for Java

Copernik XML Factory provides secure-by-default JAXP factory creation for Java. Prior to 0.1.2, Copernik XML Factory does not block XInclude resource resolution on the stock JDK provider after an application enables XInclude on a factory returned by XmlFactories.newDocumentBuilderFactory or...

libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation.

A flaw in libxml2's XInclude processing xmlXIncludeProcess and xmlXIncludeProcessTree fails to propagate parser flags like XMLPARSENONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery SSRF, XML External Entity XXE...

[SECURITY] [DLA 4862-1] inkscape security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4862-1 [email protected] https://www.debian.org/lts/security/ Simon Quigley October 26, 2026 https://wiki.debian.org/LTS -...

libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation.

A flaw in libxml2's XInclude processing xmlXIncludeProcess and xmlXIncludeProcessTree fails to propagate parser flags like XMLPARSENONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery SSRF, XML External Entity XXE...

libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation.

A flaw in libxml2's XInclude processing xmlXIncludeProcess and xmlXIncludeProcessTree fails to propagate parser flags like XMLPARSENONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery SSRF, XML External Entity XXE...

libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation.

A flaw in libxml2's XInclude processing xmlXIncludeProcess and xmlXIncludeProcessTree fails to propagate parser flags like XMLPARSENONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery SSRF, XML External Entity XXE...

Debian dla-4862 : inkscape - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dla-4862 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4862-1 [email protected] https://www.debian.org/lts/security/...

Librsvg: Use-after-free when XML includes have duplicated entities

Librsvg uses libxml2, a C library, to parse XML. When librsvg parses an SVG document which has a nested Xinclude, an XML entity declaration with a duplicate name as an existing one can cause a use-after-free error. While libxml2 is expanding an internal entity, a recursive XInclude can parse...

GHSA-CPVR-W4J5-2MPG Librsvg: Use-after-free when XML includes have duplicated entities

Librsvg uses libxml2, a C library, to parse XML. When librsvg parses an SVG document which has a nested Xinclude, an XML entity declaration with a duplicate name as an existing one can cause a use-after-free error. While libxml2 is expanding an internal entity, a recursive XInclude can parse...

Astra Linux – Vulnerability in libxml2

A issue was discovered in libxml2 before versions 2.11.7 and 2.12.x, and even before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to a use-after-free of the xmlValidatePopElement function...

CVE-2026-61586

Copernik XML Factory through "0.1.1", when running on its stock JDK provider, does not block XInclude resource resolution after an application enables XInclude on a factory returned by "XmlFactories.newDocumentBuilderFactory" or "XmlFactories.newSAXParserFactory", or on an "XMLReader" passed...

GHSA-XM28-XVQC-GXXG Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolution

Copernik XML Factory through 0.1.1, when running on its stock JDK provider, does not block XInclude resource resolution after an application enables XInclude on a factory returned by XmlFactories.newDocumentBuilderFactory or XmlFactories.newSAXParserFactory, or on an XMLReader passed through...

Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude resource resolution

Copernik XML Factory through 0.1.1, when running on its stock JDK provider, does not block XInclude resource resolution after an application enables XInclude on a factory returned by XmlFactories.newDocumentBuilderFactory or XmlFactories.newSAXParserFactory, or on an XMLReader passed through...

PT-2026-105552

Copernik XML Factory through 0.1.1, when running on its stock JDK provider, does not block XInclude resource resolution after an application enables XInclude on a factory returned by XmlFactories.newDocumentBuilderFactory or XmlFactories.newSAXParserFactory, or on an XMLReader passed through...

PT-2026-105986

Name of the Vulnerable Software and Affected Versions Copernik XML Factory versions prior to 0.1.2 Description When using the stock JDK provider where Apache Xerces is absent from the classpath, the software fails to block XInclude resource resolution if an application enables XInclude. This occu...