CVE-2026-47080

Name of the Vulnerable Software and Affected Versions joshnuss xml builder versions 0.0.7 through 2.4.0

Description An XML Injection issue in the XmlBuilder module allows for Content Spoofing and XML Injection. The problem exists within the lib/xml builder.ex file and affects the XmlBuilder.generate/1(), XmlBuilder.generate/2(), and XmlBuilder.escape/1() functions. Specifically, the escape/1() function handles {:cdata, data} by concatenating data between CDATA markers without checking for the ]]> sequence. Since CDATA sections lack an internal escape mechanism, an attacker providing input containing ]]> can prematurely close the CDATA section. This allows subsequent bytes to be interpreted as ordinary XML markup, enabling the injection of arbitrary elements, text, or entity references into the resulting document.

Recommendations Update joshnuss xml builder to version 2.4.1.