What is GHSA-7xx4-xq65-r6v3?

GHSA-7xx4-xq65-r6v3 is a security advisory published by GitHub Security Advisories with Low severity. Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction...

Which CVE IDs does GHSA-7xx4-xq65-r6v3 cover?

GHSA-7xx4-xq65-r6v3 covers the following CVE IDs: CVE-2026-15037. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-7xx4-xq65-r6v3Low

Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction...

Vendor

GitHub Security Advisories

Published

July 23, 2026

Last Modified

July 23, 2026

🔗 CVE IDs covered (1)

CVE-2026-15037 →

📋 Description

Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-15037
https://codereview.qt-project.org/c/qt/qtbase/+/748323
https://github.com/advisories/GHSA-7xx4-xq65-r6v3