CVE-2026-47079
lowpriority · track · 0EPSS 0.002 · 8 %ileUSEPSS · scored 2026-10-27
Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, Cross-site Scripting. This vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape_string/1, XmlBuilder.escape_entity/1. XmlBuilder.generate/1 does not escape literal & characters in text or attribute values when they are followed by an entity-like token (lt;, gt;, amp;, quot;, apos;). As a result, attacker-supplied input such as <script> is emitted verbatim into the serialized XML rather than being escaped to &lt;script&gt;. When a downstream XML parser later reads the document, it decodes the entity sequences into the literal characters <script>, promoting inert-looking text into real markup. This allows an attacker to bypass upstream filters that block raw < and > characters, injecting markup into any downstream consumer that parses the produced XML and renders the text content in a markup-sensitive context (HTML, SVG, RSS/Atom feeds). Both element text and attribute values are affected. This issue affects xml_builder: from 0.0.6 before 2.4.1.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (1)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- EEF-CVE-2026-47079Round-trip Corruption via Improper Entity Escaping in xml_builder2026-08-21vendor · osvUS
## Summary Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (`XmlBuilder` module) allows Content Spoofing, Cross-site Scripting. This vulnerability is associated with program files `lib/xml_builder.ex` and program routines `XmlBuilder.generate/1`, `XmlBuilder.generate/2`, `XmlBuilder.escape_string/1`, `XmlBuilder.escape_entity/1`. `XmlBuilder.generate/1` does not escape literal `&` characters in text or attribute values when they are followed by an entity-like token (`lt;`, `gt;`, `amp;`, `quot;`, `apos;`). As a result, attacker-supplied input such as `<script>` is emitted verbatim into the serialized XML rather than being escaped to `&lt;script&gt;`. When a downstream XML parser later reads the document, it decodes the entity sequences into the literal characters `<script>`, promoting inert-looking text into real markup. This allows an attacker to bypass upstream filters that block raw `<` and `>` characters, injecting markup into any downstream consumer that parses the produced XML and renders the text content in a markup-sensitive context (HTML, SVG, RSS/Atom feeds). Both element text and attribute values are affected. This issue affects xml_builder: from 0.0.6 before 2.4.1.
also known as (1)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (4) nvd
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan