EEF-CVE-2026-48590

See a problem?
Please try reporting it to the source first.
Source
https://cna.erlef.org/osv/EEF-CVE-2026-48590.html
Import Source
https://cna.erlef.org/osv/EEF-CVE-2026-48590.json
JSON Data
https://api.osv.dev/v1/vulns/EEF-CVE-2026-48590
Aliases
Published
2026-08-21T09:51:25Z
Modified
2026-09-08T05:30:35Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N CVSS Calculator
Summary
Element and Attribute Names Injected Verbatim into XML Output in xml_builder
Details

Summary

XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection.

This vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.element/1, XmlBuilder.element/2, XmlBuilder.element/3.

Element names, attribute names, and doctype identifiers are interpolated verbatim into the serialized XML output without validation or escaping of structural characters (<, >, ", ', &). An attacker who can influence a name argument (for example, an element name derived from a JSON object key or an HTTP form field name) can inject arbitrary XML markup including extra elements, comments, and event-handler attributes into the output document.

This issue affects xml_builder: from 0.0.1 before 2.4.1.

Database specific 
{
    "capec_ids": [
        "CAPEC-250"
    ],
    "cpe_ids": [
        "cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*"
    ],
    "cwe_ids": [
        "CWE-91"
    ]
}
References
Credits
    • Peter Ullrich - FINDER
    • Joshua Nussbaum - REMEDIATION_DEVELOPER
    • Jonatan Männchen / EEF - COORDINATOR

Affected packages

Hex / xml_builder

Package

Name
xml_builder
Purl
pkg:hex/xml_builder

Affected ranges

Type
SEMVER
Events
Introduced
0.0.1
Fixed
2.4.1

Affected versions

0.*
0.0.1
0.0.2
0.0.3
0.0.4
0.0.5
0.0.6
0.0.7
0.0.8
0.0.9
0.1.0
0.1.1
0.1.2
2.*
2.0.0
2.1.0
2.1.1
2.1.2
2.1.4
2.2.0
2.3.0
2.4.0

Database specific

source 
"https://cna.erlef.org/osv/EEF-CVE-2026-48590.json"

Git / github.com/joshnuss/xml_builder

Affected ranges

Type
GIT
Repo
https://github.com/joshnuss/xml_builder
Events
Introduced
9fb49131ad3ee146a4c9db9bc175bdffe32e30a0
Fixed
d5c0aec32a8eecbb440fb9bbb0f59d4d188d5859

Affected versions

v0.*
v0.0.6

Database specific

source 
"https://cna.erlef.org/osv/EEF-CVE-2026-48590.json"