XML Injection Vulnerability in XmlBuilder Module by Josh Nuss

CVE-2026-48590

What is CVE-2026-48590?

The XmlBuilder module by Josh Nuss is vulnerable to XML Injection, allowing attackers to exploit improperly validated element names, attribute names, and doctype identifiers. This security flaw occurs as these components are incorporated into the serialized XML output without adequate validation or escaping. If an attacker can control a name argument—such as one derived from JSON object keys or HTTP form fields—they can inject arbitrary XML markup. This includes not only malicious elements but also comments and event-handler attributes, leading to potential content spoofing and exploitation of user trust.

References