{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/apache-camel-org.apache.camelcamel-saxon-4.0.0-before-4.18.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:camel:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-90885"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Apache Camel (org.apache.camel:camel-saxon) 4.0.0 before 4.18.5","Apache Camel (org.apache.camel:camel-saxon) 4.19.0 before 4.22.2","Apache Camel (4.0.0 \u003c= 4.18.4, 4.19.0 \u003c= 4.22.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Camel's \u003ccode\u003ecamel-saxon\u003c/code\u003e component is vulnerable to an Improper Restriction of XML External Entity Reference vulnerability. In affected versions, the \u003ccode\u003eXQueryBuilder\u003c/code\u003e parses a message body that is already a \u003ccode\u003ejavax.xml.transform.Source\u003c/code\u003e using Saxon's default parser settings, which results in the resolution of external entities declared in the body.\u003c/p\u003e\n","date_modified":"2026-10-26T15:45:33Z","date_published":"2026-10-23T13:38:47Z","id":"https://feed.craftedsignal.io/briefs/2026-10-apache-camel-xxe/","summary":"The Apache Camel Saxon component is affected by an Improper Restriction of XML External Entity Reference vulnerability. The issue occurs when XQueryBuilder parses a message body that is already a javax.xml.transform.Source, causing the component to use Saxon's default parser settings, which resolve external entities.","title":"Apache Camel: XML External Entity Injection in Saxon Component (CVE-2026-90885)","url":"https://feed.craftedsignal.io/briefs/2026-10-apache-camel-xxe/"}],"language":"en","title":"CraftedSignal Threat Feed - Apache Camel (Org.apache.camel:camel-Saxon) 4.0.0 Before 4.18.5","version":"https://jsonfeed.org/version/1.1"}