CVE-2026-66293

Name of the Vulnerable Software and Affected Versions saxy versions 0.7.0 through 1.6.x

Description An XML injection issue exists in the encoder of Saxy. The Saxy.Encoder fails to neutralize the -- sequence within XML comment content because the escape comment/2 function returns the comment binary unchanged in every clause and only appends a space if the comment ends in a single -. Consequently, neither an interior -- nor a full --> is escaped or rejected before the encoder wraps the content in delimiters.

When an application serializes attacker-controlled text as a comment via Saxy.XML.comment/1 or a raw {:comment, text} simple form child, an attacker can prematurely close the comment using --> to inject arbitrary sibling markup into the serialized document. This allows for stored cross-site scripting when the document is rendered as HTML or SVG, or data forgery when consumed by another XML processor. This issue only affects applications that serialize untrusted text using Saxy.encode!/2 or Saxy.encode to iodata!/2.

Recommendations Update to version 1.7.0 or later. Reject or rewrite the -- sequence in untrusted text before passing it to Saxy.XML.comment/1, such as by replacing -- with - -. Stop emitting untrusted data as XML comments and move the text into an element or a CDATA section instead.