CVE-2026-48590

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-48590

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48590.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-48590

Aliases

EEF-CVE-2026-48590
GHSA-r82p-3q2p-728w

Published

2026-08-21T09:51:25.412Z

Modified

2026-08-27T11:31:02.701731979Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N CVSS Calculator

Summary

Element and Attribute Names Injected Verbatim into XML Output in xml_builder

Details

XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection.

This vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.element/1, XmlBuilder.element/2, XmlBuilder.element/3.

Element names, attribute names, and doctype identifiers are interpolated verbatim into the serialized XML output without validation or escaping of structural characters (<, >, ", ', &). An attacker who can influence a name argument (for example, an element name derived from a JSON object key or an HTTP form field name) can inject arbitrary XML markup including extra elements, comments, and event-handler attributes into the output document.

This issue affects xml_builder: from 0.0.1 before 2.4.1.

Database specific

{
    "cwe_ids": [
        "CWE-91"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48590.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "0.0.1"
                },
                {
                    "fixed": "2.4.1"
                },
                {
                    "introduced": "9fb49131ad3ee146a4c9db9bc175bdffe32e30a0"
                },
                {
                    "fixed": "d5c0aec32a8eecbb440fb9bbb0f59d4d188d5859"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "0.0.1"
                },
                {
                    "fixed": "2.4.1"
                }
            ],
            "source": "CPE_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "0.0.1"
                },
                {
                    "fixed": "2.4.1"
                }
            ],
            "source": "DESCRIPTION"
        }
    ],
    "cna_assigner": "EEF"
}

References

Affected packages

Git / github.com/joshnuss/xml_builder

Affected ranges

Type

GIT

Repo

https://github.com/joshnuss/xml_builder

Events

Introduced

Fixed

d5c0aec32a8eecbb440fb9bbb0f59d4d188d5859

Database specific

Show details

{
    "source": "REFERENCES"
}

Affected versions

v0.*

v0.0.6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48590.json"