CVE-2026-6807

NSA GRASSMARLIN Improper Restriction of XML External Entity Reference

A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of XML input, which may result in unintended exposure of sensitive information. The flaw stems from insufficient hardening of the XML parsing process.

Affected

NSA · GRASSMARLIN

CVSS v3.1 HQ

5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.14% chance of exploitation in the next 30 days, 3rd percentile

Published

2026-04-28

Updated

2026-04-29

Proof-of-concept exploits (1)

• SecTestAnnaQuinn/Grassmarlin-CVE-2026-6807-XXE-POC2★ · 2026-04-28

References

• CVE Record
• NVD entry

Related

• CVE-2026-0073