Saxon XSLT Java extension functions enable command execution in GeoNetwork formatters (CVE-2026-58400)
VulnCheck added this flaw to its known-exploited catalog on 2026-09-03, two days after fixes shipped, and The Hacker News reports it chains with CVE-2026-63219 into unauthenticated remote code execution, so unpatched public geoportal backends are exposed to takeover of the GeoNetwork host.
GeoNetwork configures its Saxon XSLT processor without FEATURE_SECURE_PROCESSING and without disabling ALLOW_EXTERNAL_FUNCTIONS, so any stylesheet it loads can call java.lang.Runtime.exec() or ProcessBuilder and run arbitrary commands as the GeoNetwork process user. On its own this needs a user privileged enough to upload a formatter, but chained with CVE-2026-63219 it becomes unauthenticated remote code execution.
Affected: geonetwork core-geonetwork >= 4.3.0, < 4.4.12; geonetwork core-geonetwork < 4.2.17
How to Test
Confirm the installed GeoNetwork version; anything below 4.4.12 on the 4.3/4.4 line or below 4.2.17 on the 4.2 line is vulnerable. Review the formatter directory and admin audit trail for recently uploaded or modified .xsl files you did not create, and check the host for unexpected child processes or shells spawned under the GeoNetwork service account.
How to Patch
Upgrade to GeoNetwork 4.4.12 or 4.2.17 (see the 4.4.12 and 4.2.17 change logs and GitHub advisories GHSA-x898-729x-cc3r and GHSA-mh22-prqr-vf42), which enable secure processing and disable Java extension functions in the Saxon XSLT processor. If you cannot upgrade immediately, restrict formatter upload to trusted administrators, remove untrusted custom formatters, and limit internet exposure of the catalog until patched.