Copernik XML Factory: XML External Entity injection via XInclude in stock JDK provider
Summary
Copernik XML Factory, a Java library for secure XML parser creation, does not block XInclude resource resolution when the stock JDK parser is used and an application enables XInclude. An attacker who can submit XML to such an application can read local files or use http references for server-side request forgery into internal networks. Exploitation requires Xerces to be absent from the classpath, explicit XInclude enabling, and untrusted XML input.
Affected
- Copernik XML Factory (eu.copernik:copernik-xml-factory) versions prior to 0.1.2
- Only the stock JDK provider is affected when Apache Xerces is not on the classpath
- The Xerces provider and the Android provider are not affected
Fixed in
- Fixed in version 0.1.2
Workaround
- Add Apache Xerces (xercesImpl) to the classpath so the library selects the unaffected Xerces provider, and verify that the application actually uses it
- Do not enable XInclude on parsers that process untrusted XML
Exploitation
- No evidence of exploitation in the wild found
- Not listed in CISA KEV
- No confirmed public proof of concept found; treat as unverified
- EPSS as provided: 0.36 % (percentile 30)
Our recommendation
- Identify whether any in-house or third-party Java application uses copernik-xml-factory before 0.1.2 (dependency tree or SBOM)
- Upgrade to version 0.1.2 or later, or apply the Xerces workaround and verify it
- Confirm that no application enables XInclude on untrusted input
- Ask software vendors for written confirmation of their status
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-xm28-xvqc-gxxg github.com
- Release v0.1.2 github.com
- Fix commit 2fa042c github.com
- Fix commit e5febc6 github.com
- GitLab Advisory Database CVE-2026-61586 advisories.gitlab.com
- OSV GHSA-xm28-xvqc-gxxg osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:32.
Original description (NVD)
Copernik XML Factory provides secure-by-default JAXP factory creation for Java. Prior to 0.1.2, Copernik XML Factory does not block XInclude resource resolution on the stock JDK provider after an application enables XInclude on a factory returned by `XmlFactories.newDocumentBuilderFactory()` or `XmlFactories.newSAXParserFactory()`, or on an `XMLReader` passed through `XmlFactories.harden()`. An application parsing untrusted XML can resolve attacker-controlled `xi:include` references to disclose local files or, through `http` references, reach internal network endpoints by server-side request forgery. Exploitation requires use of one of those factory/hardening APIs, the stock JDK provider with Apache Xerces absent from the classpath, explicit `setXIncludeAware(true)` or the equivalent reader feature, and XML from an untrusted source. The Xerces provider selected when Xerces is present and the Android provider are unaffected. This issue is fixed in version 0.1.2.
NVD references (4)
- https://github.com/copernik-eu/copernik-xml-factory/commit/2fa042c44931b0a4ddd585d62b97a8a987efd6c6
- https://github.com/copernik-eu/copernik-xml-factory/commit/e5febc6039ed4b0088245acb80ed7d6d6a7f5537
- https://github.com/copernik-eu/copernik-xml-factory/releases/tag/v0.1.2
- https://github.com/copernik-eu/copernik-xml-factory/security/advisories/GHSA-xm28-xvqc-gxxg
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.