Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
6 vulnerabilities by joshnuss
CVE-2026-48590 (GCVE-0-2026-48590)
Vulnerability from nvd – Published: 2026-08-21 09:51 – Updated: 2026-08-21 12:25
VLAI
EPSS
VEX
Title
Element and Attribute Names Injected Verbatim into XML Output in xml_builder
Summary
XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection.
This vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.element/1, XmlBuilder.element/2, XmlBuilder.element/3.
Element names, attribute names, and doctype identifiers are interpolated verbatim into the serialized XML output without validation or escaping of structural characters (<, >, ", ', &). An attacker who can influence a name argument (for example, an element name derived from a JSON object key or an HTTP form field name) can inject arbitrary XML markup including extra elements, comments, and event-handler attributes into the output document.
This issue affects xml_builder: from 0.0.1 before 2.4.1.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 12:24 UTC
CWE
- CWE-91 - XML Injection (aka Blind XPath Injection)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/joshnuss/xml_builder/security/… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-48590.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-48590 | related |
| https://github.com/joshnuss/xml_builder/commit/d5… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| joshnuss | xml_builder |
Affected:
0.0.1 , < 2.4.1
(semver)
cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:* |
|
| joshnuss | xml_builder |
Affected:
9fb49131ad3ee146a4c9db9bc175bdffe32e30a0 , < d5c0aec32a8eecbb440fb9bbb0f59d4d188d5859
(git)
cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48590",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T12:24:58.189871Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T12:25:33.127Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/joshnuss/xml_builder/security/advisories/GHSA-r82p-3q2p-728w"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.XmlBuilder\u0027"
],
"packageName": "xml_builder",
"packageURL": "pkg:hex/xml_builder",
"product": "xml_builder",
"programFiles": [
"lib/xml_builder.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/1"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/2"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:element/1"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:element/2"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:element/3"
}
],
"repo": "https://github.com/joshnuss/xml_builder",
"vendor": "joshnuss",
"versions": [
{
"lessThan": "2.4.1",
"status": "affected",
"version": "0.0.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.XmlBuilder\u0027"
],
"packageName": "joshnuss/xml_builder",
"packageURL": "pkg:github/joshnuss/xml_builder",
"product": "xml_builder",
"programFiles": [
"lib/xml_builder.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/1"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/2"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:element/1"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:element/2"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:element/3"
}
],
"repo": "https://github.com/joshnuss/xml_builder",
"vendor": "joshnuss",
"versions": [
{
"lessThan": "d5c0aec32a8eecbb440fb9bbb0f59d4d188d5859",
"status": "affected",
"version": "9fb49131ad3ee146a4c9db9bc175bdffe32e30a0",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.4.1",
"versionStartIncluding": "0.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Joshua Nussbaum"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eXML Injection vulnerability in joshnuss xml_builder (\u003ccode\u003eXmlBuilder\u003c/code\u003e module) allows Content Spoofing, XML Injection.\u003c/p\u003e\n\u003cp\u003eThis vulnerability is associated with program files \u003ccode\u003elib/xml_builder.ex\u003c/code\u003e and program routines \u003ccode\u003eXmlBuilder.generate/1\u003c/code\u003e, \u003ccode\u003eXmlBuilder.generate/2\u003c/code\u003e, \u003ccode\u003eXmlBuilder.element/1\u003c/code\u003e, \u003ccode\u003eXmlBuilder.element/2\u003c/code\u003e, \u003ccode\u003eXmlBuilder.element/3\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eElement names, attribute names, and doctype identifiers are interpolated verbatim into the serialized XML output without validation or escaping of structural characters (\u003ccode\u003e\u0026lt;\u003c/code\u003e, \u003ccode\u003e\u0026gt;\u003c/code\u003e, \u003ccode\u003e\"\u003c/code\u003e, \u003ccode\u003e\u0027\u003c/code\u003e, \u003ccode\u003e\u0026amp;\u003c/code\u003e). An attacker who can influence a name argument (for example, an element name derived from a JSON object key or an HTTP form field name) can inject arbitrary XML markup including extra elements, comments, and event-handler attributes into the output document.\u003c/p\u003e\n\u003cp\u003eThis issue affects xml_builder: from 0.0.1 before 2.4.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "XML Injection vulnerability in joshnuss xml_builder (`XmlBuilder` module) allows Content Spoofing, XML Injection.\n\nThis vulnerability is associated with program files `lib/xml_builder.ex` and program routines `XmlBuilder.generate/1`, `XmlBuilder.generate/2`, `XmlBuilder.element/1`, `XmlBuilder.element/2`, `XmlBuilder.element/3`.\n\nElement names, attribute names, and doctype identifiers are interpolated verbatim into the serialized XML output without validation or escaping of structural characters (`\u003c`, `\u003e`, `\"`, `\u0027`, `\u0026`). An attacker who can influence a name argument (for example, an element name derived from a JSON object key or an HTTP form field name) can inject arbitrary XML markup including extra elements, comments, and event-handler attributes into the output document.\n\nThis issue affects xml_builder: from 0.0.1 before 2.4.1."
}
],
"value": "XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection.\n\nThis vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.element/1, XmlBuilder.element/2, XmlBuilder.element/3.\n\nElement names, attribute names, and doctype identifiers are interpolated verbatim into the serialized XML output without validation or escaping of structural characters (\u003c, \u003e, \", \u0027, \u0026). An attacker who can influence a name argument (for example, an element name derived from a JSON object key or an HTTP form field name) can inject arbitrary XML markup including extra elements, comments, and event-handler attributes into the output document.\n\nThis issue affects xml_builder: from 0.0.1 before 2.4.1."
}
],
"impacts": [
{
"capecId": "CAPEC-250",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-250 XML Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-91",
"description": "CWE-91 XML Injection (aka Blind XPath Injection)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T09:51:25.412Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/joshnuss/xml_builder/security/advisories/GHSA-r82p-3q2p-728w"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-48590.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48590"
},
{
"tags": [
"patch"
],
"url": "https://github.com/joshnuss/xml_builder/commit/d5c0aec32a8eecbb440fb9bbb0f59d4d188d5859"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Element and Attribute Names Injected Verbatim into XML Output in xml_builder"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-48590",
"datePublished": "2026-08-21T09:51:25.412Z",
"dateReserved": "2026-05-22T09:36:56.833Z",
"dateUpdated": "2026-08-21T12:25:33.127Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47080 (GCVE-0-2026-47080)
Vulnerability from nvd – Published: 2026-08-21 09:49 – Updated: 2026-08-21 12:32
VLAI
EPSS
VEX
Title
CDATA Section Breakout via Unsanitised ]]> in xml_builder
Summary
XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection.
This vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape/1.
The escape/1 clause for {:cdata, data} in lib/xml_builder.ex concatenates data verbatim between the CDATA opener <![CDATA[ and closer ]]> without rewriting or splitting on the embedded ]]> sequence. Because CDATA sections have no internal escape mechanism, the only safe way to embed arbitrary bytes is to split on ]]> and emit adjacent CDATA sections. An attacker who can supply input containing ]]> closes the CDATA section early; any bytes that follow are parsed as ordinary XML markup by downstream consumers, allowing injection of arbitrary elements, text, or entity references into the output document.
This issue affects xml_builder: from 0.0.7 before 2.4.1.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 12:30 UTC
CWE
- CWE-91 - XML Injection (aka Blind XPath Injection)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/joshnuss/xml_builder/security/… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-47080.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-47080 | related |
| https://github.com/joshnuss/xml_builder/commit/bf… | patch |
| https://vincent.vulcoord.net/score/?state=Not+Sco… | exploit |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| joshnuss | xml_builder |
Affected:
0.0.7 , < 2.4.1
(semver)
cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:* |
|
| joshnuss | xml_builder |
Affected:
26766f884ed19adee1563522c7afb5f056a6f3b5 , < bfb1ada071ccc1e384c30f782197ca5154106706
(git)
cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47080",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T12:30:05.428465Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T12:32:15.846Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://vincent.vulcoord.net/score/?state=Not+Scored\u0026year=2026\u0026year=2025\u0026assigned_to=88bc49d9-8ddd-4227-affc-a613e67abc4d\u0026ordering=-published\u0026cve=CVE-2026-47080"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.XmlBuilder\u0027"
],
"packageName": "xml_builder",
"packageURL": "pkg:hex/xml_builder",
"product": "xml_builder",
"programFiles": [
"lib/xml_builder.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/1"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/2"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:escape/1"
}
],
"repo": "https://github.com/joshnuss/xml_builder",
"vendor": "joshnuss",
"versions": [
{
"lessThan": "2.4.1",
"status": "affected",
"version": "0.0.7",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.XmlBuilder\u0027"
],
"packageName": "joshnuss/xml_builder",
"packageURL": "pkg:github/joshnuss/xml_builder",
"product": "xml_builder",
"programFiles": [
"lib/xml_builder.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/1"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/2"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:escape/1"
}
],
"repo": "https://github.com/joshnuss/xml_builder",
"vendor": "joshnuss",
"versions": [
{
"lessThan": "bfb1ada071ccc1e384c30f782197ca5154106706",
"status": "affected",
"version": "26766f884ed19adee1563522c7afb5f056a6f3b5",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.4.1",
"versionStartIncluding": "0.0.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Joshua Nussbaum"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eXML Injection vulnerability in joshnuss xml_builder (\u003ccode\u003eXmlBuilder\u003c/code\u003e module) allows Content Spoofing, XML Injection.\u003c/p\u003e\n\u003cp\u003eThis vulnerability is associated with program files \u003ccode\u003elib/xml_builder.ex\u003c/code\u003e and program routines \u003ccode\u003eXmlBuilder.generate/1\u003c/code\u003e, \u003ccode\u003eXmlBuilder.generate/2\u003c/code\u003e, \u003ccode\u003eXmlBuilder.escape/1\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003eescape/1\u003c/code\u003e clause for \u003ccode\u003e{:cdata, data}\u003c/code\u003e in \u003ccode\u003elib/xml_builder.ex\u003c/code\u003e concatenates data verbatim between the CDATA opener \u003ccode\u003e\u0026lt;![CDATA[\u003c/code\u003e and closer \u003ccode\u003e]]\u0026gt;\u003c/code\u003e without rewriting or splitting on the embedded \u003ccode\u003e]]\u0026gt;\u003c/code\u003e sequence. Because CDATA sections have no internal escape mechanism, the only safe way to embed arbitrary bytes is to split on \u003ccode\u003e]]\u0026gt;\u003c/code\u003e and emit adjacent CDATA sections. An attacker who can supply input containing \u003ccode\u003e]]\u0026gt;\u003c/code\u003e closes the CDATA section early; any bytes that follow are parsed as ordinary XML markup by downstream consumers, allowing injection of arbitrary elements, text, or entity references into the output document.\u003c/p\u003e\n\u003cp\u003eThis issue affects xml_builder: from 0.0.7 before 2.4.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "XML Injection vulnerability in joshnuss xml_builder (`XmlBuilder` module) allows Content Spoofing, XML Injection.\n\nThis vulnerability is associated with program files `lib/xml_builder.ex` and program routines `XmlBuilder.generate/1`, `XmlBuilder.generate/2`, `XmlBuilder.escape/1`.\n\nThe `escape/1` clause for `{:cdata, data}` in `lib/xml_builder.ex` concatenates data verbatim between the CDATA opener `\u003c![CDATA[` and closer `]]\u003e` without rewriting or splitting on the embedded `]]\u003e` sequence. Because CDATA sections have no internal escape mechanism, the only safe way to embed arbitrary bytes is to split on `]]\u003e` and emit adjacent CDATA sections. An attacker who can supply input containing `]]\u003e` closes the CDATA section early; any bytes that follow are parsed as ordinary XML markup by downstream consumers, allowing injection of arbitrary elements, text, or entity references into the output document.\n\nThis issue affects xml_builder: from 0.0.7 before 2.4.1."
}
],
"value": "XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection.\n\nThis vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape/1.\n\nThe escape/1 clause for {:cdata, data} in lib/xml_builder.ex concatenates data verbatim between the CDATA opener \u003c![CDATA[ and closer ]]\u003e without rewriting or splitting on the embedded ]]\u003e sequence. Because CDATA sections have no internal escape mechanism, the only safe way to embed arbitrary bytes is to split on ]]\u003e and emit adjacent CDATA sections. An attacker who can supply input containing ]]\u003e closes the CDATA section early; any bytes that follow are parsed as ordinary XML markup by downstream consumers, allowing injection of arbitrary elements, text, or entity references into the output document.\n\nThis issue affects xml_builder: from 0.0.7 before 2.4.1."
}
],
"impacts": [
{
"capecId": "CAPEC-250",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-250 XML Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-91",
"description": "CWE-91 XML Injection (aka Blind XPath Injection)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T09:49:34.772Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/joshnuss/xml_builder/security/advisories/GHSA-67r9-hmxw-h595"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-47080.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-47080"
},
{
"tags": [
"patch"
],
"url": "https://github.com/joshnuss/xml_builder/commit/bfb1ada071ccc1e384c30f782197ca5154106706"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "CDATA Section Breakout via Unsanitised ]]\u003e in xml_builder"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-47080",
"datePublished": "2026-08-21T09:49:34.772Z",
"dateReserved": "2026-05-18T17:28:10.319Z",
"dateUpdated": "2026-08-21T12:32:15.846Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47079 (GCVE-0-2026-47079)
Vulnerability from nvd – Published: 2026-08-21 09:52 – Updated: 2026-08-21 12:19
VLAI
EPSS
VEX
Title
Round-trip Corruption via Improper Entity Escaping in xml_builder
Summary
Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, Cross-site Scripting.
This vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape_string/1, XmlBuilder.escape_entity/1.
XmlBuilder.generate/1 does not escape literal & characters in text or attribute values when they are followed by an entity-like token (lt;, gt;, amp;, quot;, apos;). As a result, attacker-supplied input such as <script> is emitted verbatim into the serialized XML rather than being escaped to &lt;script&gt;. When a downstream XML parser later reads the document, it decodes the entity sequences into the literal characters <script>, promoting inert-looking text into real markup. This allows an attacker to bypass upstream filters that block raw < and > characters, injecting markup into any downstream consumer that parses the produced XML and renders the text content in a markup-sensitive context (HTML, SVG, RSS/Atom feeds). Both element text and attribute values are affected.
This issue affects xml_builder: from 0.0.6 before 2.4.1.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 12:17 UTC
CWE
- CWE-838 - Inappropriate Encoding for Output Context
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/joshnuss/xml_builder/security/… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-47079.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-47079 | related |
| https://github.com/joshnuss/xml_builder/commit/c3… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| joshnuss | xml_builder |
Affected:
0.0.6 , < 2.4.1
(semver)
cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:* |
|
| joshnuss | xml_builder |
Affected:
aae31e6e8ac837bcbb8afb816c0d14324b5cfe2b , < c3390e2046ec297b3bb8c30d5779cdfd6508c275
(git)
cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47079",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T12:17:52.012230Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T12:19:47.179Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/joshnuss/xml_builder/security/advisories/GHSA-5hjx-8g53-cmvm"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.XmlBuilder\u0027"
],
"packageName": "xml_builder",
"packageURL": "pkg:hex/xml_builder",
"product": "xml_builder",
"programFiles": [
"lib/xml_builder.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/1"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/2"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:escape_string/1"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:escape_entity/1"
}
],
"repo": "https://github.com/joshnuss/xml_builder",
"vendor": "joshnuss",
"versions": [
{
"lessThan": "2.4.1",
"status": "affected",
"version": "0.0.6",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.XmlBuilder\u0027"
],
"packageName": "joshnuss/xml_builder",
"packageURL": "pkg:github/joshnuss/xml_builder",
"product": "xml_builder",
"programFiles": [
"lib/xml_builder.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/1"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/2"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:escape_string/1"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:escape_entity/1"
}
],
"repo": "https://github.com/joshnuss/xml_builder",
"vendor": "joshnuss",
"versions": [
{
"lessThan": "c3390e2046ec297b3bb8c30d5779cdfd6508c275",
"status": "affected",
"version": "aae31e6e8ac837bcbb8afb816c0d14324b5cfe2b",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.4.1",
"versionStartIncluding": "0.0.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Joshua Nussbaum"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (\u003ccode\u003eXmlBuilder\u003c/code\u003e module) allows Content Spoofing, Cross-site Scripting.\u003c/p\u003e\n\u003cp\u003eThis vulnerability is associated with program files \u003ccode\u003elib/xml_builder.ex\u003c/code\u003e and program routines \u003ccode\u003eXmlBuilder.generate/1\u003c/code\u003e, \u003ccode\u003eXmlBuilder.generate/2\u003c/code\u003e, \u003ccode\u003eXmlBuilder.escape_string/1\u003c/code\u003e, \u003ccode\u003eXmlBuilder.escape_entity/1\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eXmlBuilder.generate/1\u003c/code\u003e does not escape literal \u003ccode\u003e\u0026amp;\u003c/code\u003e characters in text or attribute values when they are followed by an entity-like token (\u003ccode\u003elt;\u003c/code\u003e, \u003ccode\u003egt;\u003c/code\u003e, \u003ccode\u003eamp;\u003c/code\u003e, \u003ccode\u003equot;\u003c/code\u003e, \u003ccode\u003eapos;\u003c/code\u003e). As a result, attacker-supplied input such as \u003ccode\u003e\u0026amp;lt;script\u0026amp;gt;\u003c/code\u003e is emitted verbatim into the serialized XML rather than being escaped to \u003ccode\u003e\u0026amp;amp;lt;script\u0026amp;amp;gt;\u003c/code\u003e. When a downstream XML parser later reads the document, it decodes the entity sequences into the literal characters \u003ccode\u003e\u0026lt;script\u0026gt;\u003c/code\u003e, promoting inert-looking text into real markup. This allows an attacker to bypass upstream filters that block raw \u003ccode\u003e\u0026lt;\u003c/code\u003e and \u003ccode\u003e\u0026gt;\u003c/code\u003e characters, injecting markup into any downstream consumer that parses the produced XML and renders the text content in a markup-sensitive context (HTML, SVG, RSS/Atom feeds). Both element text and attribute values are affected.\u003c/p\u003e\n\u003cp\u003eThis issue affects xml_builder: from 0.0.6 before 2.4.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (`XmlBuilder` module) allows Content Spoofing, Cross-site Scripting.\n\nThis vulnerability is associated with program files `lib/xml_builder.ex` and program routines `XmlBuilder.generate/1`, `XmlBuilder.generate/2`, `XmlBuilder.escape_string/1`, `XmlBuilder.escape_entity/1`.\n\n`XmlBuilder.generate/1` does not escape literal `\u0026` characters in text or attribute values when they are followed by an entity-like token (`lt;`, `gt;`, `amp;`, `quot;`, `apos;`). As a result, attacker-supplied input such as `\u0026lt;script\u0026gt;` is emitted verbatim into the serialized XML rather than being escaped to `\u0026amp;lt;script\u0026amp;gt;`. When a downstream XML parser later reads the document, it decodes the entity sequences into the literal characters `\u003cscript\u003e`, promoting inert-looking text into real markup. This allows an attacker to bypass upstream filters that block raw `\u003c` and `\u003e` characters, injecting markup into any downstream consumer that parses the produced XML and renders the text content in a markup-sensitive context (HTML, SVG, RSS/Atom feeds). Both element text and attribute values are affected.\n\nThis issue affects xml_builder: from 0.0.6 before 2.4.1."
}
],
"value": "Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, Cross-site Scripting.\n\nThis vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape_string/1, XmlBuilder.escape_entity/1.\n\nXmlBuilder.generate/1 does not escape literal \u0026 characters in text or attribute values when they are followed by an entity-like token (lt;, gt;, amp;, quot;, apos;). As a result, attacker-supplied input such as \u0026lt;script\u0026gt; is emitted verbatim into the serialized XML rather than being escaped to \u0026amp;lt;script\u0026amp;gt;. When a downstream XML parser later reads the document, it decodes the entity sequences into the literal characters \u003cscript\u003e, promoting inert-looking text into real markup. This allows an attacker to bypass upstream filters that block raw \u003c and \u003e characters, injecting markup into any downstream consumer that parses the produced XML and renders the text content in a markup-sensitive context (HTML, SVG, RSS/Atom feeds). Both element text and attribute values are affected.\n\nThis issue affects xml_builder: from 0.0.6 before 2.4.1."
}
],
"impacts": [
{
"capecId": "CAPEC-120",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-120 Double Encoding"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-838",
"description": "CWE-838 Inappropriate Encoding for Output Context",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T09:52:44.178Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/joshnuss/xml_builder/security/advisories/GHSA-5hjx-8g53-cmvm"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-47079.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-47079"
},
{
"tags": [
"patch"
],
"url": "https://github.com/joshnuss/xml_builder/commit/c3390e2046ec297b3bb8c30d5779cdfd6508c275"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Round-trip Corruption via Improper Entity Escaping in xml_builder"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-47079",
"datePublished": "2026-08-21T09:52:44.178Z",
"dateReserved": "2026-05-18T17:28:10.319Z",
"dateUpdated": "2026-08-21T12:19:47.179Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47079 (GCVE-0-2026-47079)
Vulnerability from cvelistv5 – Published: 2026-08-21 09:52 – Updated: 2026-08-21 12:19
VLAI
EPSS
VEX
Title
Round-trip Corruption via Improper Entity Escaping in xml_builder
Summary
Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, Cross-site Scripting.
This vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape_string/1, XmlBuilder.escape_entity/1.
XmlBuilder.generate/1 does not escape literal & characters in text or attribute values when they are followed by an entity-like token (lt;, gt;, amp;, quot;, apos;). As a result, attacker-supplied input such as <script> is emitted verbatim into the serialized XML rather than being escaped to &lt;script&gt;. When a downstream XML parser later reads the document, it decodes the entity sequences into the literal characters <script>, promoting inert-looking text into real markup. This allows an attacker to bypass upstream filters that block raw < and > characters, injecting markup into any downstream consumer that parses the produced XML and renders the text content in a markup-sensitive context (HTML, SVG, RSS/Atom feeds). Both element text and attribute values are affected.
This issue affects xml_builder: from 0.0.6 before 2.4.1.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 12:17 UTC
CWE
- CWE-838 - Inappropriate Encoding for Output Context
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/joshnuss/xml_builder/security/… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-47079.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-47079 | related |
| https://github.com/joshnuss/xml_builder/commit/c3… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| joshnuss | xml_builder |
Affected:
0.0.6 , < 2.4.1
(semver)
cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:* |
|
| joshnuss | xml_builder |
Affected:
aae31e6e8ac837bcbb8afb816c0d14324b5cfe2b , < c3390e2046ec297b3bb8c30d5779cdfd6508c275
(git)
cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47079",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T12:17:52.012230Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T12:19:47.179Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/joshnuss/xml_builder/security/advisories/GHSA-5hjx-8g53-cmvm"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.XmlBuilder\u0027"
],
"packageName": "xml_builder",
"packageURL": "pkg:hex/xml_builder",
"product": "xml_builder",
"programFiles": [
"lib/xml_builder.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/1"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/2"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:escape_string/1"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:escape_entity/1"
}
],
"repo": "https://github.com/joshnuss/xml_builder",
"vendor": "joshnuss",
"versions": [
{
"lessThan": "2.4.1",
"status": "affected",
"version": "0.0.6",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.XmlBuilder\u0027"
],
"packageName": "joshnuss/xml_builder",
"packageURL": "pkg:github/joshnuss/xml_builder",
"product": "xml_builder",
"programFiles": [
"lib/xml_builder.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/1"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/2"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:escape_string/1"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:escape_entity/1"
}
],
"repo": "https://github.com/joshnuss/xml_builder",
"vendor": "joshnuss",
"versions": [
{
"lessThan": "c3390e2046ec297b3bb8c30d5779cdfd6508c275",
"status": "affected",
"version": "aae31e6e8ac837bcbb8afb816c0d14324b5cfe2b",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.4.1",
"versionStartIncluding": "0.0.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Joshua Nussbaum"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (\u003ccode\u003eXmlBuilder\u003c/code\u003e module) allows Content Spoofing, Cross-site Scripting.\u003c/p\u003e\n\u003cp\u003eThis vulnerability is associated with program files \u003ccode\u003elib/xml_builder.ex\u003c/code\u003e and program routines \u003ccode\u003eXmlBuilder.generate/1\u003c/code\u003e, \u003ccode\u003eXmlBuilder.generate/2\u003c/code\u003e, \u003ccode\u003eXmlBuilder.escape_string/1\u003c/code\u003e, \u003ccode\u003eXmlBuilder.escape_entity/1\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eXmlBuilder.generate/1\u003c/code\u003e does not escape literal \u003ccode\u003e\u0026amp;\u003c/code\u003e characters in text or attribute values when they are followed by an entity-like token (\u003ccode\u003elt;\u003c/code\u003e, \u003ccode\u003egt;\u003c/code\u003e, \u003ccode\u003eamp;\u003c/code\u003e, \u003ccode\u003equot;\u003c/code\u003e, \u003ccode\u003eapos;\u003c/code\u003e). As a result, attacker-supplied input such as \u003ccode\u003e\u0026amp;lt;script\u0026amp;gt;\u003c/code\u003e is emitted verbatim into the serialized XML rather than being escaped to \u003ccode\u003e\u0026amp;amp;lt;script\u0026amp;amp;gt;\u003c/code\u003e. When a downstream XML parser later reads the document, it decodes the entity sequences into the literal characters \u003ccode\u003e\u0026lt;script\u0026gt;\u003c/code\u003e, promoting inert-looking text into real markup. This allows an attacker to bypass upstream filters that block raw \u003ccode\u003e\u0026lt;\u003c/code\u003e and \u003ccode\u003e\u0026gt;\u003c/code\u003e characters, injecting markup into any downstream consumer that parses the produced XML and renders the text content in a markup-sensitive context (HTML, SVG, RSS/Atom feeds). Both element text and attribute values are affected.\u003c/p\u003e\n\u003cp\u003eThis issue affects xml_builder: from 0.0.6 before 2.4.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (`XmlBuilder` module) allows Content Spoofing, Cross-site Scripting.\n\nThis vulnerability is associated with program files `lib/xml_builder.ex` and program routines `XmlBuilder.generate/1`, `XmlBuilder.generate/2`, `XmlBuilder.escape_string/1`, `XmlBuilder.escape_entity/1`.\n\n`XmlBuilder.generate/1` does not escape literal `\u0026` characters in text or attribute values when they are followed by an entity-like token (`lt;`, `gt;`, `amp;`, `quot;`, `apos;`). As a result, attacker-supplied input such as `\u0026lt;script\u0026gt;` is emitted verbatim into the serialized XML rather than being escaped to `\u0026amp;lt;script\u0026amp;gt;`. When a downstream XML parser later reads the document, it decodes the entity sequences into the literal characters `\u003cscript\u003e`, promoting inert-looking text into real markup. This allows an attacker to bypass upstream filters that block raw `\u003c` and `\u003e` characters, injecting markup into any downstream consumer that parses the produced XML and renders the text content in a markup-sensitive context (HTML, SVG, RSS/Atom feeds). Both element text and attribute values are affected.\n\nThis issue affects xml_builder: from 0.0.6 before 2.4.1."
}
],
"value": "Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, Cross-site Scripting.\n\nThis vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape_string/1, XmlBuilder.escape_entity/1.\n\nXmlBuilder.generate/1 does not escape literal \u0026 characters in text or attribute values when they are followed by an entity-like token (lt;, gt;, amp;, quot;, apos;). As a result, attacker-supplied input such as \u0026lt;script\u0026gt; is emitted verbatim into the serialized XML rather than being escaped to \u0026amp;lt;script\u0026amp;gt;. When a downstream XML parser later reads the document, it decodes the entity sequences into the literal characters \u003cscript\u003e, promoting inert-looking text into real markup. This allows an attacker to bypass upstream filters that block raw \u003c and \u003e characters, injecting markup into any downstream consumer that parses the produced XML and renders the text content in a markup-sensitive context (HTML, SVG, RSS/Atom feeds). Both element text and attribute values are affected.\n\nThis issue affects xml_builder: from 0.0.6 before 2.4.1."
}
],
"impacts": [
{
"capecId": "CAPEC-120",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-120 Double Encoding"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-838",
"description": "CWE-838 Inappropriate Encoding for Output Context",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T09:52:44.178Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/joshnuss/xml_builder/security/advisories/GHSA-5hjx-8g53-cmvm"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-47079.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-47079"
},
{
"tags": [
"patch"
],
"url": "https://github.com/joshnuss/xml_builder/commit/c3390e2046ec297b3bb8c30d5779cdfd6508c275"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Round-trip Corruption via Improper Entity Escaping in xml_builder"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-47079",
"datePublished": "2026-08-21T09:52:44.178Z",
"dateReserved": "2026-05-18T17:28:10.319Z",
"dateUpdated": "2026-08-21T12:19:47.179Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-48590 (GCVE-0-2026-48590)
Vulnerability from cvelistv5 – Published: 2026-08-21 09:51 – Updated: 2026-08-21 12:25
VLAI
EPSS
VEX
Title
Element and Attribute Names Injected Verbatim into XML Output in xml_builder
Summary
XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection.
This vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.element/1, XmlBuilder.element/2, XmlBuilder.element/3.
Element names, attribute names, and doctype identifiers are interpolated verbatim into the serialized XML output without validation or escaping of structural characters (<, >, ", ', &). An attacker who can influence a name argument (for example, an element name derived from a JSON object key or an HTTP form field name) can inject arbitrary XML markup including extra elements, comments, and event-handler attributes into the output document.
This issue affects xml_builder: from 0.0.1 before 2.4.1.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 12:24 UTC
CWE
- CWE-91 - XML Injection (aka Blind XPath Injection)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/joshnuss/xml_builder/security/… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-48590.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-48590 | related |
| https://github.com/joshnuss/xml_builder/commit/d5… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| joshnuss | xml_builder |
Affected:
0.0.1 , < 2.4.1
(semver)
cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:* |
|
| joshnuss | xml_builder |
Affected:
9fb49131ad3ee146a4c9db9bc175bdffe32e30a0 , < d5c0aec32a8eecbb440fb9bbb0f59d4d188d5859
(git)
cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48590",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T12:24:58.189871Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T12:25:33.127Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/joshnuss/xml_builder/security/advisories/GHSA-r82p-3q2p-728w"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.XmlBuilder\u0027"
],
"packageName": "xml_builder",
"packageURL": "pkg:hex/xml_builder",
"product": "xml_builder",
"programFiles": [
"lib/xml_builder.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/1"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/2"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:element/1"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:element/2"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:element/3"
}
],
"repo": "https://github.com/joshnuss/xml_builder",
"vendor": "joshnuss",
"versions": [
{
"lessThan": "2.4.1",
"status": "affected",
"version": "0.0.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.XmlBuilder\u0027"
],
"packageName": "joshnuss/xml_builder",
"packageURL": "pkg:github/joshnuss/xml_builder",
"product": "xml_builder",
"programFiles": [
"lib/xml_builder.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/1"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/2"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:element/1"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:element/2"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:element/3"
}
],
"repo": "https://github.com/joshnuss/xml_builder",
"vendor": "joshnuss",
"versions": [
{
"lessThan": "d5c0aec32a8eecbb440fb9bbb0f59d4d188d5859",
"status": "affected",
"version": "9fb49131ad3ee146a4c9db9bc175bdffe32e30a0",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.4.1",
"versionStartIncluding": "0.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Joshua Nussbaum"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eXML Injection vulnerability in joshnuss xml_builder (\u003ccode\u003eXmlBuilder\u003c/code\u003e module) allows Content Spoofing, XML Injection.\u003c/p\u003e\n\u003cp\u003eThis vulnerability is associated with program files \u003ccode\u003elib/xml_builder.ex\u003c/code\u003e and program routines \u003ccode\u003eXmlBuilder.generate/1\u003c/code\u003e, \u003ccode\u003eXmlBuilder.generate/2\u003c/code\u003e, \u003ccode\u003eXmlBuilder.element/1\u003c/code\u003e, \u003ccode\u003eXmlBuilder.element/2\u003c/code\u003e, \u003ccode\u003eXmlBuilder.element/3\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eElement names, attribute names, and doctype identifiers are interpolated verbatim into the serialized XML output without validation or escaping of structural characters (\u003ccode\u003e\u0026lt;\u003c/code\u003e, \u003ccode\u003e\u0026gt;\u003c/code\u003e, \u003ccode\u003e\"\u003c/code\u003e, \u003ccode\u003e\u0027\u003c/code\u003e, \u003ccode\u003e\u0026amp;\u003c/code\u003e). An attacker who can influence a name argument (for example, an element name derived from a JSON object key or an HTTP form field name) can inject arbitrary XML markup including extra elements, comments, and event-handler attributes into the output document.\u003c/p\u003e\n\u003cp\u003eThis issue affects xml_builder: from 0.0.1 before 2.4.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "XML Injection vulnerability in joshnuss xml_builder (`XmlBuilder` module) allows Content Spoofing, XML Injection.\n\nThis vulnerability is associated with program files `lib/xml_builder.ex` and program routines `XmlBuilder.generate/1`, `XmlBuilder.generate/2`, `XmlBuilder.element/1`, `XmlBuilder.element/2`, `XmlBuilder.element/3`.\n\nElement names, attribute names, and doctype identifiers are interpolated verbatim into the serialized XML output without validation or escaping of structural characters (`\u003c`, `\u003e`, `\"`, `\u0027`, `\u0026`). An attacker who can influence a name argument (for example, an element name derived from a JSON object key or an HTTP form field name) can inject arbitrary XML markup including extra elements, comments, and event-handler attributes into the output document.\n\nThis issue affects xml_builder: from 0.0.1 before 2.4.1."
}
],
"value": "XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection.\n\nThis vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.element/1, XmlBuilder.element/2, XmlBuilder.element/3.\n\nElement names, attribute names, and doctype identifiers are interpolated verbatim into the serialized XML output without validation or escaping of structural characters (\u003c, \u003e, \", \u0027, \u0026). An attacker who can influence a name argument (for example, an element name derived from a JSON object key or an HTTP form field name) can inject arbitrary XML markup including extra elements, comments, and event-handler attributes into the output document.\n\nThis issue affects xml_builder: from 0.0.1 before 2.4.1."
}
],
"impacts": [
{
"capecId": "CAPEC-250",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-250 XML Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-91",
"description": "CWE-91 XML Injection (aka Blind XPath Injection)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T09:51:25.412Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/joshnuss/xml_builder/security/advisories/GHSA-r82p-3q2p-728w"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-48590.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48590"
},
{
"tags": [
"patch"
],
"url": "https://github.com/joshnuss/xml_builder/commit/d5c0aec32a8eecbb440fb9bbb0f59d4d188d5859"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Element and Attribute Names Injected Verbatim into XML Output in xml_builder"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-48590",
"datePublished": "2026-08-21T09:51:25.412Z",
"dateReserved": "2026-05-22T09:36:56.833Z",
"dateUpdated": "2026-08-21T12:25:33.127Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47080 (GCVE-0-2026-47080)
Vulnerability from cvelistv5 – Published: 2026-08-21 09:49 – Updated: 2026-08-21 12:32
VLAI
EPSS
VEX
Title
CDATA Section Breakout via Unsanitised ]]> in xml_builder
Summary
XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection.
This vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape/1.
The escape/1 clause for {:cdata, data} in lib/xml_builder.ex concatenates data verbatim between the CDATA opener <![CDATA[ and closer ]]> without rewriting or splitting on the embedded ]]> sequence. Because CDATA sections have no internal escape mechanism, the only safe way to embed arbitrary bytes is to split on ]]> and emit adjacent CDATA sections. An attacker who can supply input containing ]]> closes the CDATA section early; any bytes that follow are parsed as ordinary XML markup by downstream consumers, allowing injection of arbitrary elements, text, or entity references into the output document.
This issue affects xml_builder: from 0.0.7 before 2.4.1.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 12:30 UTC
CWE
- CWE-91 - XML Injection (aka Blind XPath Injection)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/joshnuss/xml_builder/security/… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-47080.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-47080 | related |
| https://github.com/joshnuss/xml_builder/commit/bf… | patch |
| https://vincent.vulcoord.net/score/?state=Not+Sco… | exploit |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| joshnuss | xml_builder |
Affected:
0.0.7 , < 2.4.1
(semver)
cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:* |
|
| joshnuss | xml_builder |
Affected:
26766f884ed19adee1563522c7afb5f056a6f3b5 , < bfb1ada071ccc1e384c30f782197ca5154106706
(git)
cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47080",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T12:30:05.428465Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T12:32:15.846Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://vincent.vulcoord.net/score/?state=Not+Scored\u0026year=2026\u0026year=2025\u0026assigned_to=88bc49d9-8ddd-4227-affc-a613e67abc4d\u0026ordering=-published\u0026cve=CVE-2026-47080"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.XmlBuilder\u0027"
],
"packageName": "xml_builder",
"packageURL": "pkg:hex/xml_builder",
"product": "xml_builder",
"programFiles": [
"lib/xml_builder.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/1"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/2"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:escape/1"
}
],
"repo": "https://github.com/joshnuss/xml_builder",
"vendor": "joshnuss",
"versions": [
{
"lessThan": "2.4.1",
"status": "affected",
"version": "0.0.7",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.XmlBuilder\u0027"
],
"packageName": "joshnuss/xml_builder",
"packageURL": "pkg:github/joshnuss/xml_builder",
"product": "xml_builder",
"programFiles": [
"lib/xml_builder.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/1"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/2"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:escape/1"
}
],
"repo": "https://github.com/joshnuss/xml_builder",
"vendor": "joshnuss",
"versions": [
{
"lessThan": "bfb1ada071ccc1e384c30f782197ca5154106706",
"status": "affected",
"version": "26766f884ed19adee1563522c7afb5f056a6f3b5",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.4.1",
"versionStartIncluding": "0.0.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Joshua Nussbaum"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eXML Injection vulnerability in joshnuss xml_builder (\u003ccode\u003eXmlBuilder\u003c/code\u003e module) allows Content Spoofing, XML Injection.\u003c/p\u003e\n\u003cp\u003eThis vulnerability is associated with program files \u003ccode\u003elib/xml_builder.ex\u003c/code\u003e and program routines \u003ccode\u003eXmlBuilder.generate/1\u003c/code\u003e, \u003ccode\u003eXmlBuilder.generate/2\u003c/code\u003e, \u003ccode\u003eXmlBuilder.escape/1\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThe \u003ccode\u003eescape/1\u003c/code\u003e clause for \u003ccode\u003e{:cdata, data}\u003c/code\u003e in \u003ccode\u003elib/xml_builder.ex\u003c/code\u003e concatenates data verbatim between the CDATA opener \u003ccode\u003e\u0026lt;![CDATA[\u003c/code\u003e and closer \u003ccode\u003e]]\u0026gt;\u003c/code\u003e without rewriting or splitting on the embedded \u003ccode\u003e]]\u0026gt;\u003c/code\u003e sequence. Because CDATA sections have no internal escape mechanism, the only safe way to embed arbitrary bytes is to split on \u003ccode\u003e]]\u0026gt;\u003c/code\u003e and emit adjacent CDATA sections. An attacker who can supply input containing \u003ccode\u003e]]\u0026gt;\u003c/code\u003e closes the CDATA section early; any bytes that follow are parsed as ordinary XML markup by downstream consumers, allowing injection of arbitrary elements, text, or entity references into the output document.\u003c/p\u003e\n\u003cp\u003eThis issue affects xml_builder: from 0.0.7 before 2.4.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "XML Injection vulnerability in joshnuss xml_builder (`XmlBuilder` module) allows Content Spoofing, XML Injection.\n\nThis vulnerability is associated with program files `lib/xml_builder.ex` and program routines `XmlBuilder.generate/1`, `XmlBuilder.generate/2`, `XmlBuilder.escape/1`.\n\nThe `escape/1` clause for `{:cdata, data}` in `lib/xml_builder.ex` concatenates data verbatim between the CDATA opener `\u003c![CDATA[` and closer `]]\u003e` without rewriting or splitting on the embedded `]]\u003e` sequence. Because CDATA sections have no internal escape mechanism, the only safe way to embed arbitrary bytes is to split on `]]\u003e` and emit adjacent CDATA sections. An attacker who can supply input containing `]]\u003e` closes the CDATA section early; any bytes that follow are parsed as ordinary XML markup by downstream consumers, allowing injection of arbitrary elements, text, or entity references into the output document.\n\nThis issue affects xml_builder: from 0.0.7 before 2.4.1."
}
],
"value": "XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection.\n\nThis vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape/1.\n\nThe escape/1 clause for {:cdata, data} in lib/xml_builder.ex concatenates data verbatim between the CDATA opener \u003c![CDATA[ and closer ]]\u003e without rewriting or splitting on the embedded ]]\u003e sequence. Because CDATA sections have no internal escape mechanism, the only safe way to embed arbitrary bytes is to split on ]]\u003e and emit adjacent CDATA sections. An attacker who can supply input containing ]]\u003e closes the CDATA section early; any bytes that follow are parsed as ordinary XML markup by downstream consumers, allowing injection of arbitrary elements, text, or entity references into the output document.\n\nThis issue affects xml_builder: from 0.0.7 before 2.4.1."
}
],
"impacts": [
{
"capecId": "CAPEC-250",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-250 XML Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-91",
"description": "CWE-91 XML Injection (aka Blind XPath Injection)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T09:49:34.772Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/joshnuss/xml_builder/security/advisories/GHSA-67r9-hmxw-h595"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-47080.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-47080"
},
{
"tags": [
"patch"
],
"url": "https://github.com/joshnuss/xml_builder/commit/bfb1ada071ccc1e384c30f782197ca5154106706"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "CDATA Section Breakout via Unsanitised ]]\u003e in xml_builder"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-47080",
"datePublished": "2026-08-21T09:49:34.772Z",
"dateReserved": "2026-05-18T17:28:10.319Z",
"dateUpdated": "2026-08-21T12:32:15.846Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}