Critical Cross-Site Scripting Vulnerability in xmlrpc-c Package
Summary
RLSA-2026:64772: Important: xmlrpc-c security update. Affects xmlrpc-c versions < 0:1.51.0-11.el8_10.1. Fixed in 0:1.51.0-11.el8_10.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The xmlrpc-c package provides a network protocol that enables client programs to perform remote procedure calls (RPC) over the Internet using XML and HTTP. It is widely used for its simplicity in encoding RPC calls into XML documents, which are then transmitted to a remote server. This package is essential for applications that rely on remote communication and data exchange. However, it is vulnerable to a critical security issue that can lead to Cross-Site Scripting (XSS) attacks, compromising the integrity of applications utilizing this library.
Vulnerability Detail
The vulnerability identified as CVE-2026-15928 is a Cross-Site Scripting (XSS) flaw found in the error page component of the xmlrpc-c library. This issue arises when the library fails to properly sanitize user input, allowing attackers to inject malicious scripts into the error messages displayed to users. If exploited, this vulnerability can lead to unauthorized access to sensitive information, session hijacking, and other malicious activities. The CVSS score for this vulnerability is 7.4, indicating a high severity level.
How To Fix
Minimum fixed version
0:1.51.0-11.el8_10.1
This is the first release that contains the fix.
sudo dnf update xmlrpc-cTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation and sanitization in your application to mitigate the risk of XSS attacks. This can involve encoding user inputs and ensuring that error messages do not display raw user data. However, the best solution is to update to the patched version of the xmlrpc-c package.
Conclusion
The xmlrpc-c package has a critical vulnerability (CVE-2026-15928) that can lead to Cross-Site Scripting attacks. It is crucial to update to the patched version to protect your applications from potential exploitation. Implementing additional security measures such as input validation can further enhance your application's security.
See every vulnerability recorded for xmlrpc-c →
FAQ
CVE-2026-15928 is a Cross-Site Scripting vulnerability in the xmlrpc-c package that allows attackers to inject malicious scripts into error messages.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
Exploitation of this vulnerability can lead to unauthorized access, session hijacking, and exposure of sensitive information.
Update the xmlrpc-c package to the latest patched version and implement input validation and sanitization in your application.
Yes, Vulert provides real-time monitoring and alerts for open-source vulnerabilities using just a manifest file, without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for xmlrpc-c.
