EEF-CVE-2026-47079

Round-trip Corruption via Improper Entity Escaping in xml_builder

## Summary Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (`XmlBuilder` module) allows Content Spoofing, Cross-site Scripting. This vulnerability is associated with program files `lib/xml_builder.ex` and program routines `XmlBuilder.generate/1`, `XmlBuilder.generate/2`, `XmlBuilder.escape_string/1`, `XmlBuilder.escape_entity/1`. `XmlBuilder.generate/1` does not escape literal `&` characters in text or attribute values when they are followed by an entity-like token (`lt;`, `gt;`, `amp;`, `quot;`, `apos;`). As a result, attacker-supplied input such as `&lt;script&gt;` is emitted verbatim into the serialized XML rather than being escaped to `&amp;lt;script&amp;gt;`. When a downstream XML parser later reads the document, it decodes the entity sequences into the literal characters `<script>`, promoting inert-looking text into real markup. This allows an attacker to bypass upstream filters that block raw `<` and `>` characters, injecting markup into any downstream consumer that parses the produced XML and renders the text content in a markup-sensitive context (HTML, SVG, RSS/Atom feeds). Both element text and attribute values are affected. This issue affects xml_builder: from 0.0.6 before 2.4.1.