CVE-2026-15037 — XML injection vulnerability in QDom comment, CDATA and processing-instruction serialization
Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialize…
Published: 2026-07-23 · CVSS: 2.9 · CVSS 4.0
Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7