Content Spoofing and Cross-site Scripting Vulnerability in XmlBuilder by Josh Nuss

CVE-2026-47079

What is CVE-2026-47079?

The XmlBuilder module by Josh Nuss suffers from an inappropriate encoding for output context vulnerability. Specifically, the methods XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape_string/1, and XmlBuilder.escape_entity/1 fail to properly escape specific characters. When attacker-controlled input includes tokens resembling XML entities, such as <script>, it escapes incorrectly, resulting in raw script insertion. This oversight allows attackers to manipulate the serialized XML output, leading to potential Cross-site Scripting (XSS) and content spoofing incidents when the output is parsed by downstream systems. Both element text and attribute values are at risk, emphasizing the need for immediate updates if using affected versions.

References