PT-2026-79346 · Hexpm · Xml Builder
CVSS v4.0
2.1
Low
| Vector | AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
joshnuss xml builder versions 0.0.6 through 2.4.0
Description
Inappropriate encoding for output context in the
XmlBuilder module allows for Content Spoofing and Cross-site Scripting (XSS). The issue resides in the lib/xml builder.ex file and affects the XmlBuilder.generate/1(), XmlBuilder.generate/2(), XmlBuilder.escape string/1(), and XmlBuilder.escape entity/1() routines. Specifically, XmlBuilder.generate/1() fails to escape literal & characters in text or attribute values when they are followed by entity-like tokens such as lt;, gt;, amp;, quot;, or apos;. This allows attacker-supplied input to be emitted verbatim into the serialized XML. When a downstream XML parser processes the document, it decodes these sequences into literal characters, enabling the injection of markup into consumers that render the content in markup-sensitive contexts like HTML, SVG, or RSS/Atom feeds.Recommendations
Update joshnuss xml builder to version 2.4.1 or later.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Xml Builder