CVE-2026-47079
LowCVSS 2.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (XmlBuilder module) allows content spoofing and cross-site scripting. XmlBuilder.generate/1 does not escape '&' characters when followed by entity-like tokens, allowing injection of XML markup. Affects versions from 0.0.6 before 2.4.1.
Risk Assessment
An attacker can bypass filters blocking raw '<' and '>' characters, injecting XML markup that may be interpreted as HTML or other formats, leading to XSS or content spoofing.
Recommendation
Upgrade xml_builder to version 2.4.1 or later, which includes the fix for escaping '&' characters.
Other vulnerabilities in xml_builder
See all- CVE-2026-48590Low
XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows content spoofing and XML injection. Element names, attribute names, and doctype identifiers are interpolated without validation, allowing injection of arbitrary XML markup. Affects versions from 0.0.1 before 2.4.1.
- CVE-2026-47080Low
XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows content spoofing and XML injection. The escape/1 function for CDATA data does not handle the ']]>' sequence, allowing premature closure and injection of arbitrary XML. Affects versions from 0.0.7 before 2.4.1.
Original NVD description (English source)
Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, Cross-site Scripting. This vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape_string/1, XmlBuilder.escape_entity/1. XmlBuilder.generate/1 does not escape literal & characters in text or attribute values when they are followed by an entity-like token (lt;, gt;, amp;, quot;, apos;). As a result, attacker-supplied input such as <script> is emitted verbatim into the serialized XML rather than being escaped to &lt;script&gt;. When a downstream XML parser later reads the document, it decodes the entity sequences into the literal characters <script>, promoting inert-looking text into real markup. This allows an attacker to bypass upstream filters that block raw < and > characters, injecting markup into any downstream consumer that parses the produced XML and renders the text content in a markup-sensitive context (HTML, SVG, RSS/Atom feeds). Both element text and attribute values are affected. This issue affects xml_builder: from 0.0.6 before 2.4.1.