CVE-2026-48590
LowCVSS 2.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows content spoofing and XML injection. Element names, attribute names, and doctype identifiers are interpolated without validation, allowing injection of arbitrary XML markup. Affects versions from 0.0.1 before 2.4.1.
Risk Assessment
An attacker can inject malicious XML into generated documents, potentially leading to content spoofing or attacks on XML processors.
Recommendation
Upgrade xml_builder to version 2.4.1 or later, which includes the validation and escaping fix.
Other vulnerabilities in xml_builder
See all- CVE-2026-47080Low
XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows content spoofing and XML injection. The escape/1 function for CDATA data does not handle the ']]>' sequence, allowing premature closure and injection of arbitrary XML. Affects versions from 0.0.7 before 2.4.1.
- CVE-2026-47079Low
Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (XmlBuilder module) allows content spoofing and cross-site scripting. XmlBuilder.generate/1 does not escape '&' characters when followed by entity-like tokens, allowing injection of XML markup. Affects versions from 0.0.6 before 2.4.1.
Original NVD description (English source)
XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection. This vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.element/1, XmlBuilder.element/2, XmlBuilder.element/3. Element names, attribute names, and doctype identifiers are interpolated verbatim into the serialized XML output without validation or escaping of structural characters (<, >, ", ', &). An attacker who can influence a name argument (for example, an element name derived from a JSON object key or an HTTP form field name) can inject arbitrary XML markup including extra elements, comments, and event-handler attributes into the output document. This issue affects xml_builder: from 0.0.1 before 2.4.1.