CVE-2026-15037
LowCVSS 2.9Summary
Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.
Risk Assessment
The risk is XML injection by an attacker, potentially leading to data integrity compromise or XML External Entity (XXE) attacks.
Recommendation
Update Qt library to version 6.12 or later, and consider changing the default InvalidDataPolicy to a more restrictive one if feasible.
Original NVD description (English source)
Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.