CVE-2018-1000840

6.5 mediumEPSS 2.2%

Medium (6.5) in processing processing. EPSS 2.2% chance of exploitation in the next 30 days.

Processing Foundation Processing version 3.4 and earlier contains a XML External Entity (XXE) vulnerability in loadXML() function that can result in An attacker can read arbitrary files and exfiltrate their contents via HTTP requests. This attack appear to be exploitable via The victim must use Processing to parse a crafted XML document.

Severity

CVSS 3.0

6.5 medium

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS: 2.2% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
CWE: CWE-611
Published: 2018-12-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

processing:processing

References

https://github.com/processing/processing/issues/5706
https://twitter.com/ben_fry/status/1054333613465059329
https://github.com/processing/processing/issues/5706
https://twitter.com/ben_fry/status/1054333613465059329

Check your stack JSON