CVE-2026-61586

waiting for further signals

GHSA-xm28-xvqc-gxxg ↗

no check availablenot proven exploitable

awaiting cvepublic pockev

maven:eu.copernik:copernik-xml-factory < 0.1.2

fixed in 0.1.2

ETK-2026-486, permanent identifier

pkg:maven/eu.copernik/copernik-xml-factory

cvss8.2cna vendorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

17d 18h 37msince last run

8mAI analysis

timeline

0 = trigger signal

trigger signal +0dwaiting for further signals+1.0d

+5d

+10d

+15d

+20d

description

Copernik XML Factory through 0.1.1 may fail to keep XInclude resource retrieval disabled when applications use the stock JDK XML provider. An attacker able to supply XML could cause local-file disclosure or requests to internal services if XInclude is enabled and the application parses that untrusted input.

mitigation

Upgrade eu.copernik:copernik-xml-factory to 0.1.2. Until upgrading, use the Apache Xerces provider rather than the stock JDK provider.

fixed in 0.1.2

check

exploit

automation

contextual

auth required

EPSS

–

agent run time

cve.org record, t = 0

not published yet

Δ to public poc

–

Δ to kev

–

outcome

Contextual: an exploit technique exists, but no deterministic check could cover this one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-02 18:27Z
ghsa: trigger signal, started the run
https://github.com/advisories/GHSA-xm28-xvqc-gxxg

this entry in the feed

GET /api/v1/feed/CVE-2026-61586

{
  "etk_id": "ETK-2026-486",
  "cve_id": "CVE-2026-61586",
  "display_id": "CVE-2026-61586",
  "ghsa_id": "GHSA-xm28-xvqc-gxxg",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Unrestricted XInclude resolution in Copernik XML Factory",
  "summary": "Copernik XML Factory through 0.1.1 may fail to keep XInclude resource retrieval disabled when applications use the stock JDK XML provider. An attacker able to supply XML could cause local-file disclosure or requests to internal services if XInclude is enabled and the application parses that untrusted input.",
  "mitigation": "Upgrade eu.copernik:copernik-xml-factory to 0.1.2. Until upgrading, use the Apache Xerces provider rather than the stock JDK provider.",
  "vendor": "maven",
  "product": "maven:eu.copernik:copernik-xml-factory",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 0.1.2"
      ],
      "ecosystem": "maven",
      "fixed_versions": [
        "0.1.2"
      ],
      "package_name": "eu.copernik:copernik-xml-factory",
      "purl": "pkg:maven/eu.copernik/copernik-xml-factory"
    }
  ],
  "cwes": null,
  "cvss_score": 8.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 7.76592135,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-02T18:27:17+00:00",
      "days": -18.797528824247685,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T13:35:43.512206+00:00",
      "url": "https://github.com/advisories/GHSA-xm28-xvqc-gxxg"
    }
  }
}

published 2026-10-03 18:50Z
last change 2026-10-21 13:29Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.