{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-47079", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-05-18T17:28:10.319Z", "datePublished": "2026-08-21T09:52:44.178Z", "dateUpdated": "2026-08-21T12:19:47.179Z" }, "containers": { "cna": { "affected": [ { "collectionURL": "https://repo.hex.pm", "cpes": [ "cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "modules": [ "'Elixir.XmlBuilder'" ], "packageName": "xml_builder", "packageURL": "pkg:hex/xml_builder", "product": "xml_builder", "programFiles": [ "lib/xml_builder.ex" ], "programRoutines": [ { "name": "'Elixir.XmlBuilder':generate/1" }, { "name": "'Elixir.XmlBuilder':generate/2" }, { "name": "'Elixir.XmlBuilder':escape_string/1" }, { "name": "'Elixir.XmlBuilder':escape_entity/1" } ], "repo": "https://github.com/joshnuss/xml_builder", "vendor": "joshnuss", "versions": [ { "lessThan": "2.4.1", "status": "affected", "version": "0.0.6", "versionType": "semver" } ] }, { "collectionURL": "https://github.com", "cpes": [ "cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*" ], "defaultStatus": "unaffected", "modules": [ "'Elixir.XmlBuilder'" ], "packageName": "joshnuss/xml_builder", "packageURL": "pkg:github/joshnuss/xml_builder", "product": "xml_builder", "programFiles": [ "lib/xml_builder.ex" ], "programRoutines": [ { "name": "'Elixir.XmlBuilder':generate/1" }, { "name": "'Elixir.XmlBuilder':generate/2" }, { "name": "'Elixir.XmlBuilder':escape_string/1" }, { "name": "'Elixir.XmlBuilder':escape_entity/1" } ], "repo": "https://github.com/joshnuss/xml_builder", "vendor": "joshnuss", "versions": [ { "lessThan": "c3390e2046ec297b3bb8c30d5779cdfd6508c275", "status": "affected", "version": "aae31e6e8ac837bcbb8afb816c0d14324b5cfe2b", "versionType": "git" } ] } ], "cpeApplicability": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.4.1", "versionStartIncluding": "0.0.6", "vulnerable": true } ], "negate": false, "operator": "OR" } ], "operator": "AND" } ], "credits": [ { "lang": "en", "type": "finder", "value": "Peter Ullrich" }, { "lang": "en", "type": "remediation developer", "value": "Joshua Nussbaum" }, { "lang": "en", "type": "coordinator", "value": "Jonatan Männchen / EEF" } ], "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "

Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, Cross-site Scripting.

\n

This vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape_string/1, XmlBuilder.escape_entity/1.

\n

XmlBuilder.generate/1 does not escape literal & characters in text or attribute values when they are followed by an entity-like token (lt;, gt;, amp;, quot;, apos;). As a result, attacker-supplied input such as &lt;script&gt; is emitted verbatim into the serialized XML rather than being escaped to &amp;lt;script&amp;gt;. When a downstream XML parser later reads the document, it decodes the entity sequences into the literal characters <script>, promoting inert-looking text into real markup. This allows an attacker to bypass upstream filters that block raw < and > characters, injecting markup into any downstream consumer that parses the produced XML and renders the text content in a markup-sensitive context (HTML, SVG, RSS/Atom feeds). Both element text and attribute values are affected.

\n

This issue affects xml_builder: from 0.0.6 before 2.4.1.

" }, { "base64": false, "type": "text/markdown", "value": "Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (`XmlBuilder` module) allows Content Spoofing, Cross-site Scripting.\n\nThis vulnerability is associated with program files `lib/xml_builder.ex` and program routines `XmlBuilder.generate/1`, `XmlBuilder.generate/2`, `XmlBuilder.escape_string/1`, `XmlBuilder.escape_entity/1`.\n\n`XmlBuilder.generate/1` does not escape literal `&` characters in text or attribute values when they are followed by an entity-like token (`lt;`, `gt;`, `amp;`, `quot;`, `apos;`). As a result, attacker-supplied input such as `<script>` is emitted verbatim into the serialized XML rather than being escaped to `&lt;script&gt;`. When a downstream XML parser later reads the document, it decodes the entity sequences into the literal characters `