An XML injection (improper output neutralization) vulnerability in the Qt XMLQDom comment, CDATA section, and processing-instruction serialization of the Qt Framework (QtXml module) has been discovered and has been assigned the CVE id CVE-2026-15037.
Affected versions: all Qt 4 and Qt 5 and Qt 6 releases before Qt 6.12 (default QDomImplementation::InvalidDataPolicy of AcceptInvalidChars).
Impact: An application that inserts untrusted text into a QDom comment, CDATA section, or processing-instruction node and then serializes the document may emit XML in which the untrusted text closes the intended node and injects attacker-controlled sibling markup, corrupting the structure of the produced document. There is no impact on confidentiality and no code execution or denial-of-service within Qt itself.
CVSS 4.0 Score: 2.9 (LOW)
Vector String:CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Mitigation: On all affected versions, set the invalid-data policy before building documents:QDomImplementation::setInvalidDataPolicy(QDomImplementation::ReturnNullNode); (or DropInvalidChars). With ReturnNullNode, the QDom factory functions return a null node when given data that is invalid per XML 1.0 — check the return value. As additional defence-in-depth, validate untrusted input before inserting it and do not treat QDom output as trusted structure downstream.
Solution: Update to Qt 6.12 or later, where the default InvalidDataPolicy is ReturnNullNode. On Qt 6.11 and earlier the default is unchanged; apply the mitigation above.
Patches:
