XML Injection in xml_builder 0.0.72.4.1 via Unchecked CDATA
CVE-2026-47080 Published on August 21, 2026

CDATA Section Breakout via Unsanitised ]]> in xml_builder
XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection. This vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape/1. The escape/1 clause for {:cdata, data} in lib/xml_builder.ex concatenates data verbatim between the CDATA opener <![CDATA[ and closer ]]> without rewriting or splitting on the embedded ]]> sequence. Because CDATA sections have no internal escape mechanism, the only safe way to embed arbitrary bytes is to split on ]]> and emit adjacent CDATA sections. An attacker who can supply input containing ]]> closes the CDATA section early; any bytes that follow are parsed as ordinary XML markup by downstream consumers, allowing injection of arbitrary elements, text, or entity references into the output document. This issue affects xml_builder: from 0.0.7 before 2.4.1.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-47080 is exploitable with local system access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE

Weakness Type

What is an aka Blind XPath Injection Vulnerability?

The software does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system. Within XML, special elements could include reserved words or characters such as "<", ">", """, and "&", which could then be used to add new data or modify XML syntax.

CVE-2026-47080 has been classified to as an aka Blind XPath Injection vulnerability or weakness.


Products Associated with CVE-2026-47080

Want to know whenever a new CVE is published for Joshnuss Xml Builder? stack.watch will email you.

Joshnuss Xml Builder
 

Affected Versions

joshnuss xml_builder: joshnuss xml_builder: