CVE-2026-22186: Bio-Formats XML External Entity (XXE) Vulnerability
Summary
CVE-2026-22186: Bio-Formats has an XML External Entity (XXE) vulnerability. Affects ome:pom-bio-formats versions < 8.3.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bio-Formats is an open-source library designed for reading and writing biological image data formats. It is widely used in scientific research for its ability to handle various metadata formats, particularly in microscopy. The library's functionality includes parsing metadata from different imaging systems, which is crucial for accurate data analysis. However, versions up to and including 8.3.0 are vulnerable to an XML External Entity (XXE) attack, which can compromise the security of systems using this library.
Vulnerability Detail
The vulnerability arises from an insecurely configured DocumentBuilderFactory used in the Leica Microsystems metadata parsing component of Bio-Formats. This configuration allows attackers to exploit the XML parsing process by crafting malicious metadata files. Such files can trigger outbound network requests (Server-Side Request Forgery - SSRF), access local system resources, or cause denial of service during XML parsing. The potential ramifications include unauthorized data access, system compromise, and disruption of service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid processing untrusted XML metadata files until the library is updated. Additionally, consider implementing input validation to filter out potentially malicious XML content.
Conclusion
The Bio-Formats library has a critical XML External Entity (XXE) vulnerability in versions up to 8.3.0, which can lead to serious security issues. Users are strongly advised to update to version 8.3.1 or later to mitigate these risks. Utilizing tools like Vulert can help monitor and identify vulnerabilities in your applications effectively.
See every vulnerability recorded for ome:pom-bio-formats →
FAQ
An XXE vulnerability allows an attacker to interfere with the processing of XML data, potentially leading to unauthorized access to sensitive data or system resources.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your pom.xml without needing to sign up.
Consequences can include unauthorized data access, SSRF attacks, denial of service, and exposure of sensitive information from the local system.
Yes, the vulnerability has been patched in Bio-Formats version 8.3.1. It is recommended to update to this version or later.
The CVSS score for this vulnerability is 4.6, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for ome:pom-bio-formats.
