CVE-2026-15037: 
Qt vulnerability analysis and mitigation

CVE-2026-15037 is an XML injection vulnerability (CWE-91) in Qt's QDom XML serialization component, affecting Qt XML versions 4.0.0 through 6.11. The flaw allows untrusted text serialized into comment, CDATA, or processing-instruction nodes to inject arbitrary XML markup, because node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). It was published on July 23, 2026, and carries a CVSS v4 base score of 2.9 (Low) (GitHub Advisory). The fix was introduced in Qt 6.12.

The root cause is improper output neutralization (CWE-91) in Qt's QDomDocument serialization logic. When an application writes untrusted text into XML comment (<!-- -->), CDATA (<![CDATA[...]]>), or processing-instruction nodes, Qt does not escape the respective node terminators (e.g., -->, ]]>) under the default InvalidDataPolicy::AcceptInvalidChars setting. This allows an attacker who controls the text content of such nodes to break out of the node context and inject arbitrary XML markup into the serialized output. The patch is available in the Qt code review system (Qt Code Review), and exploitation requires that the application passes attacker-controlled data into these specific node types (GitHub Advisory).

Successful exploitation allows an attacker to inject arbitrary XML markup into documents serialized by a Qt-based application, potentially enabling XML entity injection, XXE (XML External Entity) attacks, or XML-based data tampering depending on how the serialized output is subsequently consumed. The primary impact is on data integrity (unauthorized modification of XML document structure), with no direct confidentiality or availability impact from the injection itself. However, downstream processing of the malformed XML — such as by XML parsers that resolve external entities — could escalate the impact to information disclosure or server-side request forgery (GitHub Advisory).

No public proof-of-concept exploit code or active in-the-wild exploitation has been observed as of the time of publication (GitHub Advisory). The CVE status is listed as "Deferred" and the NVD SSVC assessment indicates exploitation is "none." The EPSS score is approximately 0.262% (18th percentile), reflecting a low near-term exploitation probability. Exploitation requires the presence of an attack prerequisite — specifically, that attacker-controlled text is passed into QDom comment, CDATA, or processing-instruction nodes by the target application. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Identify a vulnerable application: Find a Qt-based application (using Qt 4.0.0–6.11) that accepts user-supplied input and serializes it into XML comment, CDATA, or processing-instruction nodes using QDomDocument.
2. Craft a malicious payload: Prepare input text containing the node terminator sequence for the target node type — e.g., --> to escape an XML comment, ]]> to escape a CDATA section, or ?> to escape a processing instruction — followed by arbitrary XML markup (e.g., a new element, entity reference, or DOCTYPE declaration).
3. Inject the payload: Submit the crafted input through the application's input vector (e.g., a form field, API parameter, or file upload) so that it is stored or processed as the text content of the vulnerable node type.
4. Trigger serialization: Cause the application to serialize the QDomDocument containing the injected node to an XML string or file, at which point the unescaped terminator breaks out of the node context and the injected markup becomes part of the XML structure.
5. Exploit downstream processing: If the resulting XML is parsed by another component (e.g., an XML parser with external entity resolution enabled), leverage the injected markup to perform XXE, data exfiltration, or further XML-based attacks (GitHub Advisory, Qt Code Review).

• File System: XML output files or logs containing unexpected node terminator sequences (-->, ]]>, ?>) followed by injected XML markup within what should be comment, CDATA, or processing-instruction content.
• Logs: Application logs showing malformed XML being generated or XML parse errors in downstream consumers that process Qt-serialized output.
• Network: Outbound HTTP/DNS requests from the XML-processing server to unexpected external hosts, which may indicate successful XXE exploitation triggered by injected external entity references in the malformed XML.

The primary remediation is to upgrade to Qt 6.12 or later, which fixes the escaping behavior in QDomDocument serialization (GitHub Advisory, Qt Code Review). As a workaround for applications that cannot immediately upgrade, configure InvalidDataPolicy to reject invalid characters (e.g., QDomDocument::InvalidDataPolicy::ReturnNullNode or AbortOnInvalidChars) rather than using the default AcceptInvalidChars. Additionally, implement strict input validation and output encoding for any untrusted text before it is placed into XML comment, CDATA, or processing-instruction nodes, and restrict what untrusted data can be serialized into these node types.

Qt published a security advisory blog post shortly after disclosure (Qt Security Blog). Community discussion appeared on programming.dev, and the vulnerability was indexed by multiple security aggregators including VulDB, Vulners, and INCIBE-CERT. Overall community sentiment reflects the low severity rating, with no significant alarm given the absence of active exploitation and the availability of a patch.