CVE-2018-1000889

Logisim Evolution version 2.14.3 and earlier contains an XML External Entity (XXE) vulnerability in Circuit file loading functionality (loadXmlFrom in src/com/cburch/logisim/file/XmlReader.java) that can result in information leak, possible RCE depending on system configuration. This attack appears to be exploitable via the victim opening a specially crafted circuit file. This vulnerability appears to have been fixed in 2.14.4.

• CWE-611

• https://github.com/reds-heig/logisim-evolution/pull/139Patch, Third Party Advisory
• https://www.kvakil.me/posts/logisim/Third Party Advisory
• https://github.com/reds-heig/logisim-evolution/pull/139Patch, Third Party Advisory
• https://www.kvakil.me/posts/logisim/Third Party Advisory

Published

Dec 28, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1000883Elixir Plug Plug version All contains a Header Injection vul…
• CVE-2018-1000884Vesta CP version Prior to commit f6f6f9cfbbf2979e301956d1c6a…
• CVE-2018-1000885PHKP version including commit 88fd9cfdf14ea4b6ac3e3967feea7b…
• CVE-2018-1000886nasm version 2.14.01rc5, 2.15 contains a Buffer Overflow vul…
• CVE-2018-1000887Peel shopping peel-shopping_9_1_0 version contains a Cross S…
• CVE-2018-1000888PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-50…
• CVE-2018-1000890FrontAccounting 2.4.5 contains a Time Based Blind SQL Inject…
• CVE-2018-1000891Bitcoin SV before 0.1.1 allows uncontrolled resource consump…7.5
• CVE-2018-1000892Bitcoin SV before 0.1.1 allows uncontrolled resource consump…7.5
• CVE-2018-1000893Bitcoin SV before 0.1.1 allows uncontrolled resource consump…7.5
• CVE-2018-1000997A path traversal vulnerability exists in the Stapler web fra…
• CVE-2018-1000998FreeBSD CVSweb version 2.x contains a Cross Site Scripting (…