CVE-2026-19614

Name of the Vulnerable Software and Affected Versions NanoXML version 2.2.3

Description The API is prone to XML external entity (XXE) injection because XML external entity support is enabled by default. XXE is a type of attack where an application processes XML input containing a reference to an external entity, potentially allowing an attacker to read arbitrary files or perform server-side request forgery.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.