EEF-CVE-2026-47080
- Source
- https://cna.erlef.org/osv/EEF-CVE-2026-47080.html
- Import Source
- https://cna.erlef.org/osv/EEF-CVE-2026-47080.json
- JSON Data
- https://api.osv.dev/v1/vulns/EEF-CVE-2026-47080
- Aliases
-
- CVE-2026-47080
- GHSA-67r9-hmxw-h595
- Published
- 2026-08-21T09:49:34.772Z
- Modified
- 2026-08-21T10:11:02.119647691Z
- Severity
-
- 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N CVSS Calculator
- Summary
- CDATA Section Breakout via Unsanitised ]]> in xml_builder
- Details
-
Summary
XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection.
This vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape/1.
The escape/1 clause for {:cdata, data} in lib/xml_builder.ex concatenates data verbatim between the CDATA opener without rewriting or splitting on the embedded ]]> sequence. Because CDATA sections have no internal escape mechanism, the only safe way to embed arbitrary bytes is to split on ]]> and emit adjacent CDATA sections. An attacker who can supply input containing ]]> closes the CDATA section early; any bytes that follow are parsed as ordinary XML markup by downstream consumers, allowing injection of arbitrary elements, text, or entity references into the output document.
This issue affects xml_builder: from 0.0.7 before 2.4.1.
- Database specific
{ "cwe_ids": [ "CWE-91" ], "cpe_ids": [ "cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*" ], "capec_ids": [ "CAPEC-250" ] }- References
- Credits
-
-
- Peter Ullrich - FINDER
-
- Joshua Nussbaum - REMEDIATION_DEVELOPER
-
- Jonatan Männchen / EEF - COORDINATOR
-
Affected packages
Hex / xml_builder
Package
- Name
- xml_builder
- Purl
- pkg:hex/xml_builder