CVE-2026-15928: XMLRPC-C Library XSS Vulnerability

CVE-2026-15928 Overview

CVE-2026-15928 is a reflected cross-site scripting (XSS) vulnerability affecting XMLRPC-C Library versions 1.07 through 1.67.01. The flaw resides in the error page component, which fails to properly sanitize user-controlled input before reflecting it back in the response. An attacker can craft a malicious URL that, when visited by a victim, executes arbitrary JavaScript in the context of the vulnerable application. The vulnerability is categorized under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation allows attackers to execute arbitrary script in a victim's browser, enabling session hijacking, credential theft, and phishing attacks against users of applications built on XMLRPC-C.

Affected Products

XMLRPC-C Library version 1.07 (lower bound)
XMLRPC-C Library versions between 1.07 and 1.67.01
XMLRPC-C Library version 1.67.01 (upper bound)

Discovery Timeline

2026-07-27 - CVE CVE-2026-15928 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-15928

Vulnerability Analysis

The XMLRPC-C library provides C and C++ implementations for XML-RPC clients and servers. The affected error page component reflects attacker-controlled input directly into HTML output without applying appropriate encoding or sanitization. When a request triggers an error condition, the library returns an error page that embeds request-derived values into the response body.

Because the payload originates from the request itself, the attack is reflected rather than stored. An attacker delivers a crafted URL through phishing, social engineering, or embedded links. Victim interaction is required, but authentication is not, which broadens the pool of exploitable targets.

The scope of impact extends beyond the vulnerable component. Injected script executes in the browser session of the visiting user, giving the attacker access to cookies, tokens, and DOM contents accessible from that origin.

Root Cause

The root cause is missing output encoding in the error page generation path. Values derived from the HTTP request are concatenated into the error response body without HTML entity encoding, allowing <, >, ", and ' characters to break out of their intended textual context and introduce executable script tags or event handlers.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker constructs a URL containing a JavaScript payload in a parameter that the XMLRPC-C error handler reflects. Delivery typically occurs through phishing email, chat links, or malicious web pages that redirect to the vulnerable endpoint.

The vulnerability manifests in the error page rendering routine within XMLRPC-C. See the Missing Link Security Advisory for technical details on the affected code path.

Detection Methods for CVE-2026-15928

Indicators of Compromise

HTTP requests to XMLRPC-C endpoints containing URL-encoded <script>, onerror=, onload=, or javascript: payloads in query parameters or path components.
Server access logs showing unusually long or malformed request parameters directed at XML-RPC error-triggering paths.
Referer headers pointing to attacker-controlled domains preceding requests to XMLRPC-C-backed services.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect inbound requests for reflected XSS signatures targeting XML-RPC endpoints.
Perform software composition analysis on applications and appliances to identify XMLRPC-C versions between 1.07 and 1.67.01.
Instrument client-side Content Security Policy (CSP) violation reporting to surface unexpected inline script execution.

Monitoring Recommendations

Monitor egress traffic from user workstations for anomalous connections following interaction with links pointing to XMLRPC-C-backed services.
Track error response volumes from XML-RPC endpoints; spikes may indicate probing for the vulnerable code path.
Correlate authentication anomalies, such as session reuse from new geolocations, with prior clicks on external XML-RPC links.

How to Mitigate CVE-2026-15928

Immediate Actions Required

Inventory all applications, appliances, and embedded systems that ship with or link against XMLRPC-C between versions 1.07 and 1.67.01.
Restrict external network exposure of XML-RPC endpoints until a patched build is deployed.
Deploy WAF signatures that block HTML metacharacters and script fragments in parameters reaching XML-RPC handlers.

Patch Information

Refer to the XMLRPC-C Project Homepage and the Missing Link Security Advisory for the latest fixed release information. Upgrade to a version later than 1.67.01 once available from the upstream project. Downstream distributions may ship backported patches; consult vendor advisories for platform-specific packages.

Workarounds

Front the vulnerable service with a reverse proxy that strips or encodes HTML metacharacters in request parameters before they reach XMLRPC-C.
Set a strict Content Security Policy header on responses to block inline script execution and untrusted script sources.
Configure the HttpOnly and Secure flags on session cookies to reduce the impact of successful script execution.

bash

# Example nginx configuration to add a restrictive CSP and cookie flags
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'" always;
add_header X-Content-Type-Options "nosniff" always;
proxy_cookie_flags ~ secure httponly samesite=strict;