CVE-2026-66295

Name of the Vulnerable Software and Affected Versions saxy versions 0.7.0 through 1.6.x

Description The XML encoder fails to validate or escape the target and content of processing instructions, writing them verbatim into the output document. Because the sequence ?> terminates a processing instruction, an attacker can use this sequence to close the construct prematurely and inject arbitrary elements, attributes, and further processing instructions into the serialized document. This occurs because the encoder concatenates fields without checking them against XML specification constraints. The Saxy.XML.processing instruction/2 function is a public builder that allows this flaw to be inherited. This can lead to XML injection, resulting in forged records, injected stylesheets, or active content when the output is processed by a downstream parser or browser. The issue is triggered when a {:processing instruction, name, content} node is passed to Saxy.encode!/2 or Saxy.encode to iodata!/2 using untrusted input.

Recommendations Update saxy to version 1.7.0 or later. As a temporary workaround, avoid placing untrusted data in processing instructions. Validate dynamic values before building the node by rejecting any content containing ?> and any target that does not match the XML Name production or equals xml case-insensitively. Carry dynamic values in element content or attributes instead of processing instructions.