CVE-2026-53723

Name of the Vulnerable Software and Affected Versions Guzzle Services versions prior to 1.5.4

Description Guzzle Services fails to safely serialize scalar XML element values that contain the CDATA terminator ]]>. The XML request serializer utilizes XMLWriter::writeCData($value) for values containing <, >, or &. When attacker-controlled input includes ]]>, the CDATA section closes prematurely, causing the remaining input to be interpreted as XML markup. This results in an outgoing request-body integrity issue where attackers can inject elements outside the intended text node. This can lead to altered operation semantics, smuggling of privileged fields, bypassing of modeled parameter boundaries, or the creation of conflicting duplicated elements in the downstream service.

This issue occurs when the application uses guzzlehttp/guzzle-services to serialize outgoing requests, a request parameter or additionalParameters schema uses location: xml, the value is serialized as XML element text, and the value contains untrusted input not constrained by a safe enum, pattern, or custom filter.

Recommendations Update to version 1.5.4 or later. As a temporary workaround, constrain attacker-controlled XML element values with a strict enum, pattern, or custom filter that excludes ]]>, or avoid serializing untrusted data into location: xml element text.