CVE-2026-48590

Name of the Vulnerable Software and Affected Versions xml builder versions 0.0.1 through 2.4.0

Description An XML Injection issue in the XmlBuilder module allows for Content Spoofing and XML Injection. The problem occurs because element names, attribute names, and doctype identifiers are interpolated directly into the serialized XML output without validation or escaping of structural characters such as <, >, ", ', and &. An attacker capable of influencing a name argument—such as an element name derived from an HTTP form field or a JSON object key—can inject arbitrary XML markup, including comments, extra elements, and event-handler attributes. This issue is associated with the file lib/xml builder.ex and the functions XmlBuilder.generate/1(), XmlBuilder.generate/2(), XmlBuilder.element/1(), XmlBuilder.element/2(), and XmlBuilder.element/3().

Recommendations Update xml builder to version 2.4.1 or later.