CVE-2026-66294

Name of the Vulnerable Software and Affected Versions saxy versions 0.7.0 through 1.6.x

Description XML injection occurs in the Saxy XML encoder because the Saxy.Encoder.cdata/1 function serializes {:cdata, characters} nodes by wrapping characters between <![CDATA[ and ]]> without neutralizing the payload. While other paths escape XML metacharacters, the CDATA path does not handle the ]]> substring, which is the only way to terminate a CDATA section. An attacker can provide untrusted text containing ]]> to terminate the section prematurely, allowing subsequent input to be parsed as XML markup. This enables the injection of arbitrary sibling elements and attributes into the document structure. This issue impacts services generating SOAP envelopes, RSS, Atom feeds, sitemaps, SVG, or XML exports from user-supplied content. The vulnerability is triggered when using Saxy.XML.cdata/1 in conjunction with Saxy.encode!/2 or Saxy.encode to iodata!/2.

Recommendations Update saxy to version 1.7.0 or later. As a temporary workaround, render untrusted text as ordinary character data by passing a plain string or Saxy.XML.characters/1 to the element builder instead of using CDATA. If CDATA is required, manually replace all occurrences of ]]> in untrusted text with ]]]]><![CDATA[> before passing the result to Saxy.XML.cdata/1.