---
id: CVE-2026-61586
aliases:
  - GHSA-xm28-xvqc-gxxg
title: >-
  Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude
  resource resolution
summary: >-
  Copernik XML Factory (stock JDK provider) has Improper restriction of XInclude
  resource resolution
severity: high
cwe:
  - CWE-611
vendor: copernik
product: 'eu.copernik:copernik-xml-factory'
ecosystem: maven
affected:
  - 'eu.copernik:copernik-xml-factory < 0.1.2'
patched:
  - 'eu.copernik:copernik-xml-factory 0.1.2'
published: '2026-10-02'
updated: '2026-10-02'
sourceUpdated: '2026-10-02T18:27:20Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-xm28-xvqc-gxxg'
references:
  - url: >-
      https://github.com/copernik-eu/copernik-xml-factory/security/advisories/GHSA-xm28-xvqc-gxxg
  - url: >-
      https://github.com/copernik-eu/copernik-xml-factory/commit/2fa042c44931b0a4ddd585d62b97a8a987efd6c6
  - url: >-
      https://github.com/copernik-eu/copernik-xml-factory/commit/e5febc6039ed4b0088245acb80ed7d6d6a7f5537
  - url: 'https://github.com/copernik-eu/copernik-xml-factory/releases/tag/v0.1.2'
  - url: 'https://github.com/advisories/GHSA-xm28-xvqc-gxxg'
tags:
  - ghsa
  - maven
ingestedAt: '2026-10-02T22:33:09.859Z'
---

## Overview

Copernik XML Factory through `0.1.1`, when running on its stock JDK provider, does not block XInclude resource resolution after an application enables XInclude on a factory returned by `XmlFactories.newDocumentBuilderFactory()` or `XmlFactories.newSAXParserFactory()`, or on an `XMLReader` passed through `XmlFactories.harden()`. The library's documented guarantee that XInclude resolution stays disabled therefore does not hold on that provider.

An application that parses untrusted XML in this configuration can be made to resolve `xi:include` references, allowing an attacker to read local files (information disclosure) or, through `http` hrefs, reach internal network endpoints (SSRF).

All of the following conditions must hold for an application to be affected:
- it obtains a factory from `XmlFactories.newDocumentBuilderFactory()` or `XmlFactories.newSAXParserFactory()`, or hardens an externally obtained `XMLReader` with `XmlFactories.harden()`;
- the stock JDK provider is in effect, that is, Apache Xerces is not on the classpath;
- XInclude is enabled, by calling `setXIncludeAware(true)` or the equivalent reader feature;
- it parses XML from an untrusted source.

The Xerces provider (selected when Xerces is on the classpath) and the Android provider are not affected.

Applications are advised to upgrade to `0.1.2`, which fixes the defect. As a workaround add Apache Xerces (`xercesImpl`) to the classpath so the library selects its unaffected Xerces provider.

### Acknowledgements

The maintainer thank the following people for finding, reporting, and helping to remediate this issue:

- Finders: Ta Duc Thien and Duc Anh Nguyen (Danzation)
- Remediation developer: Ta Duc Thien
- Tooling: Claude Code (Anthropic), Claude Opus 4.8

## Affected packages

- `eu.copernik:copernik-xml-factory < 0.1.2`

## Remediation

Upgrade to a patched release:

- `eu.copernik:copernik-xml-factory 0.1.2`