Critical Security Update for xmlrpc-c: Cross-Site Scripting Vulnerability
Summary
ALSA-2026:64772: Important: xmlrpc-c security update. Affects xmlrpc-c versions < 1.51.0-11.el8_10.1. Fixed in 1.51.0-11.el8_10.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The xmlrpc-c package is a library that implements the XML-RPC protocol, allowing remote procedure calls over the Internet using XML and HTTP. This package is widely used in various applications to facilitate communication between clients and servers. The recent discovery of a Cross-Site Scripting (XSS) vulnerability in the error page component of xmlrpc-c poses significant risks, potentially allowing attackers to execute malicious scripts in the context of a user's session.
Vulnerability Detail
The vulnerability identified as CVE-2026-15928 is a Cross-Site Scripting (XSS) flaw found in the error page component of the xmlrpc-c library. This issue arises when the application fails to properly sanitize user input, allowing attackers to inject malicious scripts. If exploited, this vulnerability could lead to unauthorized actions being performed on behalf of the user, data theft, or session hijacking. The impact of this vulnerability is critical, as it can compromise the security of web applications relying on xmlrpc-c for remote procedure calls.
How To Fix
Minimum fixed version
1.51.0-11.el8_10.1
This is the first release that contains the fix.
sudo dnf update xmlrpc-cTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation and sanitization on the server-side to prevent the execution of potentially harmful scripts. However, this is not a substitute for applying the official patch, and users are strongly encouraged to update to the latest version as soon as possible.
Conclusion
The xmlrpc-c library has a critical vulnerability that requires immediate attention. By updating to the patched version 1.51.0-11.el8_10.1, users can protect their applications from potential exploitation. Regular updates and monitoring for vulnerabilities are essential practices for maintaining software security.
See every vulnerability recorded for xmlrpc-c →
FAQ
xmlrpc-c is a library that implements the XML-RPC protocol, enabling remote procedure calls over the Internet using XML and HTTP.
The vulnerability is a Cross-Site Scripting (XSS) flaw that allows attackers to inject malicious scripts into the error page component of xmlrpc-c.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability could lead to unauthorized actions, data theft, or session hijacking, compromising the security of users and applications.
It is recommended to regularly check for updates and apply them promptly to ensure your software is protected against known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for xmlrpc-c.
