CVE-2026-47080

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-47080

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47080.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-47080

Aliases

EEF-CVE-2026-47080
GHSA-67r9-hmxw-h595

Published

2026-08-21T09:49:34Z

Modified

2026-08-27T11:31:12Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N CVSS Calculator

Summary

CDATA Section Breakout via Unsanitised ]]> in xml_builder

Details

XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection.

This vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape/1.

The escape/1 clause for {:cdata, data} in lib/xml_builder.ex concatenates data verbatim between the CDATA opener without rewriting or splitting on the embedded ]]> sequence. Because CDATA sections have no internal escape mechanism, the only safe way to embed arbitrary bytes is to split on ]]> and emit adjacent CDATA sections. An attacker who can supply input containing ]]> closes the CDATA section early; any bytes that follow are parsed as ordinary XML markup by downstream consumers, allowing injection of arbitrary elements, text, or entity references into the output document.

This issue affects xml_builder: from 0.0.7 before 2.4.1.

Database specific

{
    "cna_assigner": "EEF",
    "cwe_ids": [
        "CWE-91"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47080.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "0.0.7"
                },
                {
                    "fixed": "2.4.1"
                },
                {
                    "introduced": "26766f884ed19adee1563522c7afb5f056a6f3b5"
                },
                {
                    "fixed": "bfb1ada071ccc1e384c30f782197ca5154106706"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "0.0.7"
                },
                {
                    "fixed": "2.4.1"
                }
            ],
            "source": "CPE_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "0.0.7"
                },
                {
                    "fixed": "2.4.1"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

References

Affected packages

Git / github.com/joshnuss/xml_builder

Affected ranges

Type

GIT

Repo

https://github.com/joshnuss/xml_builder

Events

Introduced

Fixed

bfb1ada071ccc1e384c30f782197ca5154106706

Database specific

Show details

{
    "source": "REFERENCES"
}

Affected versions

v0.*

v0.0.6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47080.json"