CVE-2026-61586: Copernik XML Factory XInclude resource resolution bypass

CVE-2026-61586 · Severity: high · CVSS 4 · Published 2026-10-30

Copernik XML Factory is a library that hardens Java's standard XML parser against attacks. When running on the default Java parser (without Apache Xerces), it fails to block XInclude directives in untrusted XML documents, allowing attackers to read local files or access internal network services. Applications that parse untrusted XML with XInclude enabled are vulnerable.

Vendors: Maven.

Quick answers

Is CVE-2026-61586 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-61586 being exploited in the wild.
How severe is CVE-2026-61586?
High severity, with a CVSS score of 4, published 30 October 2026.
Which products and versions are affected?
Copernik XML Factory through 0.1.1; eu.copernik:copernik-xml-factory (Maven) < 0.1.2, ECOSYSTEM:introduced=0,fixed=0.1.2.
Is there a fix for CVE-2026-61586?
Yes. eu.copernik:copernik-xml-factory (Maven): upgrade to 0.1.2 or later. Until then: Add Apache Xerces (xercesImpl) to the classpath so the library selects its unaffected Xerces provider instead of the stock JDK provider. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61586 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-61586?
Check whether you run Copernik XML Factory or eu.copernik:copernik-xml-factory (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • eu.copernik:copernik-xml-factory (Maven): upgrade to 0.1.2 or later
    # set eu.copernik:copernik-xml-factory to 0.1.2 in your pom.xml or build.gradle

Add Apache Xerces (xercesImpl) to the classpath so the library selects its unaffected Xerces provider instead of the stock JDK provider.

Technical details

The stock JDK XML parser provider in Copernik XML Factory does not properly restrict XInclude resource resolution, despite the library's documented guarantee that XInclude remains disabled. An attacker can exploit this by injecting xi:include references in untrusted XML to read arbitrary local files or perform SSRF attacks via http hrefs. The vulnerability requires the application to explicitly enable XInclude and parse untrusted XML; the Xerces and Android providers are unaffected.

Affected products

  • Copernik XML Factory through 0.1.1

Identifiers

  • CVE-2026-61586
  • GHSA-xm28-xvqc-gxxg

Timeline

  • 2026-10-02: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.