CVE-2026-62971

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-62971", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-14T22:48:09.780Z", "datePublished": "2026-11-11T17:27:52.994Z", "dateUpdated": "2026-11-11T17:27:52.994Z"}, "containers": {"cna": {"title": "OWASP CRS: XML Attribute Value Bypass", "problemTypes": [{"descriptions": [{"cweId": "CWE-138", "lang": "en", "description": "CWE-138: Improper Neutralization of Special Elements", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/coreruleset/coreruleset/security/advisories/GHSA-6jp8-c2w2-x7wr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/coreruleset/coreruleset/security/advisories/GHSA-6jp8-c2w2-x7wr"}, {"name": "https://github.com/owasp-modsecurity/ModSecurity/issues/3591", "tags": ["x_refsource_MISC"], "url": "https://github.com/owasp-modsecurity/ModSecurity/issues/3591"}, {"name": "https://github.com/coreruleset/coreruleset/commit/275d7616f1ceb6f1024c3bfbeb1f4ae2ae9ad010", "tags": ["x_refsource_MISC"], "url": "https://github.com/coreruleset/coreruleset/commit/275d7616f1ceb6f1024c3bfbeb1f4ae2ae9ad010"}, {"name": "https://github.com/coreruleset/coreruleset/commit/635cecf8f81908f02a687db4b5b13a55c3e3b9ed", "tags": ["x_refsource_MISC"], "url": "https://github.com/coreruleset/coreruleset/commit/635cecf8f81908f02a687db4b5b13a55c3e3b9ed"}, {"name": "https://github.com/coreruleset/coreruleset/commit/852036b6af5e81d60d7234f69137d47f4ecb89dc", "tags": ["x_refsource_MISC"], "url": "https://github.com/coreruleset/coreruleset/commit/852036b6af5e81d60d7234f69137d47f4ecb89dc"}], "affected": [{"vendor": "coreruleset", "product": "coreruleset", "versions": [{"version": "< 3.3.10", "status": "affected"}, {"version": "< 4.25.1", "status": "affected"}, {"version": "< 4.28.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-11T17:27:52.994Z"}, "descriptions": [{"lang": "en", "value": "The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, CRS rules in the 921 (protocol-attack), 930 (LFI), 931 (RFI), 932 (RCE), 933 (PHP), 934 (generic), 941 (XSS), 942 (SQLi), and 943 (session-fixation) families inspect XML request bodies via the XPath expression XML:/*. That expression matches only element text nodes \u2014 it does not match XML attribute values. As a result, an attacker who places an attack payload inside an XML attribute (e.g. <a href=\"javascript:alert(1)=window.name\"></a> or <a value=\"' OR 1=1 --\"></a>) bypasses CRS detection entirely. This is verified empirically against a local CRS test instance and against the public CRS sandbox. The bypass affects approximately 159 rules across 9 rule files and applies at every paranoia level (PL1 through PL4), since the variable list is more or less shared across PLs. The 944 (Java) family is the only one that correctly includes XML://@* in addition to XML:/* and is therefore unaffected. This issue has been patched in versions 3.3.10, 4.25.1, and 4.28.0."}], "source": {"advisory": "GHSA-6jp8-c2w2-x7wr", "discovery": "UNKNOWN"}}}}

{}

{"affected": [{"affectedData": [{"product": "coreruleset", "vendor": "coreruleset", "versions": [{"status": "affected", "version": "< 3.3.10"}, {"status": "affected", "version": "< 4.25.1"}, {"status": "affected", "version": "< 4.28.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, CRS rules in the 921 (protocol-attack), 930 (LFI), 931 (RFI), 932 (RCE), 933 (PHP), 934 (generic), 941 (XSS), 942 (SQLi), and 943 (session-fixation) families inspect XML request bodies via the XPath expression XML:/*. That expression matches only element text nodes \u2014 it does not match XML attribute values. As a result, an attacker who places an attack payload inside an XML attribute (e.g. <a href=\"javascript:alert(1)=window.name\"></a> or <a value=\"' OR 1=1 --\"></a>) bypasses CRS detection entirely. This is verified empirically against a local CRS test instance and against the public CRS sandbox. The bypass affects approximately 159 rules across 9 rule files and applies at every paranoia level (PL1 through PL4), since the variable list is more or less shared across PLs. The 944 (Java) family is the only one that correctly includes XML://@* in addition to XML:/* and is therefore unaffected. This issue has been patched in versions 3.3.10, 4.25.1, and 4.28.0."}], "id": "CVE-2026-62971", "lastModified": "2026-11-12T22:18:35.610", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-11-11T18:19:47.603", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/coreruleset/coreruleset/commit/275d7616f1ceb6f1024c3bfbeb1f4ae2ae9ad010"}, {"source": "security-advisories@github.com", "url": "https://github.com/coreruleset/coreruleset/commit/635cecf8f81908f02a687db4b5b13a55c3e3b9ed"}, {"source": "security-advisories@github.com", "url": "https://github.com/coreruleset/coreruleset/commit/852036b6af5e81d60d7234f69137d47f4ecb89dc"}, {"source": "security-advisories@github.com", "url": "https://github.com/coreruleset/coreruleset/security/advisories/GHSA-6jp8-c2w2-x7wr"}, {"source": "security-advisories@github.com", "url": "https://github.com/owasp-modsecurity/ModSecurity/issues/3591"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-138"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.3.10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.25.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.28.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "coreruleset", "source": "cna", "vendor": "coreruleset"}, "product": "coreruleset", "vendor": "coreruleset"}], "created": "2026-11-12T20:00:09.317738+00:00", "updated": "2026-11-13T07:00:10.312686+00:00", "vendors": ["coreruleset", "coreruleset$PRODUCT$coreruleset"]}