{"cvss":9.1,"datePublished":"2026-09-03T00:00:00Z","dateUpdated":"2026-09-03T00:00:00Z","description":"GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing (`FEATURE_SECURE_PROCESSING`) and without disabling Java extension functions (`ALLOW_EXTERNAL_FUNCTIONS`). Any stylesheet loaded by GeoNetwork can therefore invoke\n`java.lang.Runtime.exec()` or `java.lang.ProcessBuilder` directly, achieving arbitrary command execution as the GeoNetwork process user. A user with sufficient privileges to upload a formatter can deliver a `.xsl` file containing Java extension call that execute arbitrary OS commands with the privileges of the GeoNetwork process. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17.","dueDate":"","id":"CVE-2026-58400","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"Core-Geonetwork","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"CRITICAL","source":"vulncheck_kev","title":"OSGeo geonetwork Improper Control of Generation of Code","vendor":"Geonetwork"}