CVE-2026-6807: GRASSMARLIN XXE Vulnerability

CVE-2026-6807 Overview

CVE-2026-6807 is an XML External Entity (XXE) vulnerability affecting GRASSMARLIN v3.2.1, an open-source network situational awareness tool for industrial control system (ICS) networks. The flaw exists in the application's XML parsing logic, which fails to harden against malicious external entity references. An attacker with local access and low privileges can supply crafted session data that triggers improper XML handling. Successful exploitation results in unintended disclosure of sensitive information from the host system. The issue is classified under CWE-611: Improper Restriction of XML External Entity Reference.

Critical Impact
Crafted XML session files processed by GRASSMARLIN v3.2.1 can expose sensitive local information through XXE injection, undermining confidentiality of analyst workstations used in ICS environments.

Affected Products

GRASSMARLIN v3.2.1
Earlier GRASSMARLIN releases sharing the same XML parser configuration
ICS network analyst workstations running the affected version

Discovery Timeline

2026-04-28 - CVE-2026-6807 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-6807

Vulnerability Analysis

GRASSMARLIN parses session data encoded in XML to reconstruct prior network analysis state. The XML parser does not disable external entity resolution, allowing a malicious session file to reference external resources during parsing. When an analyst loads a crafted session, the parser dereferences these entities and may read local files, internal URIs, or environment-accessible resources. The parser's output is then incorporated into application state, where attacker-controlled data can be observed or exfiltrated through subsequent application behavior. The vulnerability affects only confidentiality; data integrity and availability remain unaffected per the CVSS vector.

Root Cause

The root cause is insufficient hardening of the XML parsing process. The underlying parser is instantiated without disabling DOCTYPE declarations, external general entities, or external parameter entities. This configuration is the canonical pattern flagged by [CWE-611]. Because GRASSMARLIN treats session files as trusted input, no upstream validation prevents the malicious XML from reaching the parser.

Attack Vector

Exploitation requires local access with low privileges. The attacker delivers a crafted GRASSMARLIN session file to a target workstation through shared storage, removable media, or social engineering. When the user opens the session file, the parser resolves entities pointing to local resources such as configuration files, certificates, or files within the user's profile. Resolved content is exposed through the application interface or logged outputs. The attack does not require user interaction beyond opening the malicious session, and no network reachability to the victim is needed.

No public proof-of-concept code is currently available. Refer to the CISA ICS Advisory ICSA-26-118-01 for authoritative technical details.

Detection Methods for CVE-2026-6807

Indicators of Compromise

GRASSMARLIN session files (.gm3 or XML) containing <!DOCTYPE declarations or <!ENTITY definitions referencing file://, http://, or https:// URIs
Unexpected outbound network connections initiated by the GRASSMARLIN process to attacker-controlled hosts during session load
Read access by the GRASSMARLIN process to sensitive files outside its working directory, such as SSH keys, browser data, or credential stores

Detection Strategies

Inspect XML session files at rest for DOCTYPE and ENTITY tokens using static content scanning before they are opened by analysts
Monitor process telemetry for the GRASSMARLIN executable performing file reads outside its installation and project directories
Alert on DNS or HTTP egress originating from analyst workstations correlated with GRASSMARLIN session import activity

Monitoring Recommendations

Enable file integrity monitoring on directories used to store GRASSMARLIN session artifacts
Capture and retain process command-line and file-access events from ICS analyst hosts for retrospective hunting
Baseline normal GRASSMARLIN network behavior so deviations during session parsing are visible

How to Mitigate CVE-2026-6807

Immediate Actions Required

Restrict GRASSMARLIN session imports to files originating from trusted, version-controlled repositories
Run GRASSMARLIN under a least-privilege user account with no access to sensitive credential or certificate stores
Apply application allowlisting so only approved GRASSMARLIN binaries can execute on analyst workstations
Review the CISA ICS Advisory ICSA-26-118-01 and the CSAF advisory document for vendor guidance

Patch Information

No vendor patch has been documented in the available references at the time of CVE publication. Consult the CISA ICS advisory and project repository for updated remediation status. Until a fixed release is available, treat all third-party GRASSMARLIN session files as untrusted input.

Workarounds

Pre-process XML session files to strip DOCTYPE and ENTITY declarations before loading them in GRASSMARLIN
Isolate GRASSMARLIN execution within a virtual machine or sandbox that has no access to production credentials or sensitive files
Block outbound network egress from analyst workstations to non-approved destinations to limit out-of-band exfiltration during XXE exploitation

bash

# Strip DOCTYPE and ENTITY declarations from session XML before import
sed -i -E '/<!DOCTYPE[^>]*>/d; /<!ENTITY[^>]*>/d' suspect_session.xml

# Verify no external entity references remain
grep -E 'DOCTYPE|ENTITY|SYSTEM|PUBLIC' suspect_session.xml && echo 'BLOCK' || echo 'OK'