{"api_version":"1","generated_at":"2026-07-23T13:21:32+00:00","cve":"CVE-2018-1000840","urls":{"html":"https://cve.report/CVE-2018-1000840","api":"https://cve.report/api/cve/CVE-2018-1000840.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2018-1000840","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000840"},"summary":{"title":"CVE-2018-1000840","description":"Processing Foundation Processing version 3.4 and earlier contains a XML External Entity (XXE) vulnerability in loadXML() function that can result in An attacker can read arbitrary files and exfiltrate their contents via HTTP requests. This attack appear to be exploitable via The victim must use Processing to parse a crafted XML document.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2018-12-20 15:29:00","updated_at":"2019-02-07 14:59:00"},"problem_types":["CWE-611"],"metrics":[],"references":[{"url":"https://github.com/processing/processing/issues/5706","name":"https://github.com/processing/processing/issues/5706","refsource":"MISC","tags":["Exploit","Patch","Third Party Advisory"],"title":"CVE-2018-1000840 - XXE in loadXML()  · Issue #5706 · processing/processing · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://twitter.com/ben_fry/status/1054333613465059329","name":"https://twitter.com/ben_fry/status/1054333613465059329","refsource":"MISC","tags":["Third Party Advisory"],"title":"Ben Fry na Twitterze: \"That XML parsing code is inherited from Java. But what you're calling a vulnerability is a bit like saying loadStrings() can open any file that the user has permissions for (i.e. /etc/passwd and others).… https://t.co/nMiK9HLnyR\"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000840","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000840","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2018","cve_id":"1000840","vulnerable":"1","versionEndIncluding":"3.4","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"processing","cpe5":"processing","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","DATE_ASSIGNED":"2018-11-27T13:54:33.476966","DATE_REQUESTED":"2018-10-22T13:34:23","ID":"CVE-2018-1000840","REQUESTER":"me@lucapezzolla.com","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Processing Foundation Processing version 3.4 and earlier contains a XML External Entity (XXE) vulnerability in loadXML() function that can result in An attacker can read arbitrary files and exfiltrate their contents via HTTP requests. This attack appear to be exploitable via The victim must use Processing to parse a crafted XML document."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://github.com/processing/processing/issues/5706","refsource":"MISC","url":"https://github.com/processing/processing/issues/5706"},{"name":"https://twitter.com/ben_fry/status/1054333613465059329","refsource":"MISC","url":"https://twitter.com/ben_fry/status/1054333613465059329"}]}},"nvd":{"publishedDate":"2018-12-20 15:29:00","lastModifiedDate":"2019-02-07 14:59:00","problem_types":["CWE-611"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:N/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4.3},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:processing:processing:*:*:*:*:*:*:*:*","versionEndIncluding":"3.4","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2018","CveId":"1000840","Ordinal":"140627","Title":"CVE-2018-1000840","CVE":"CVE-2018-1000840","Year":"2018"},"notes":[{"CveYear":"2018","CveId":"1000840","Ordinal":"1","NoteData":"Processing Foundation Processing version 3.4 and earlier contains a XML External Entity (XXE) vulnerability in loadXML() function that can result in An attacker can read arbitrary files and exfiltrate their contents via HTTP requests. This attack appear to be exploitable via The victim must use Processing to parse a crafted XML document.","Type":"Description","Title":null},{"CveYear":"2018","CveId":"1000840","Ordinal":"2","NoteData":"2018-12-20","Type":"Other","Title":"Published"}]}}}