CVE-2018-1000834: Runelite

Critical severity, CVSS 9.0. EPSS: 1.4% chance of exploitation in the next 30 days.

runelite version <= runelite-parent-1.4.23 contains a XML External Entity (XXE) vulnerability in Man in the middle runscape services call that can result in Disclosure of confidential data, denial of service, SSRF, port scanning.

Affected products

• Runelite Runelite: up to and including 1.4.23

Published 2018-12-20. Last modified 2026-06-17.