CVE-2026-47079 json
Round-trip Corruption via Improper Entity Escaping in xml_builder
published 2026-08-21 2 mo ago modified 2026-10-16 23 d ago also EEF-CVE-2026-47079 , EUVD-2026-63880 , GHSA-5hjx-8g53-cmvm
- cvss
- 2.1
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 8%
- public exploits
- 0
- none known
Summary
Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, Cross-site Scripting.
This vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape_string/1, XmlBuilder.escape_entity/1.
XmlBuilder.generate/1 does not escape literal & characters in text or attribute values when they are followed by an entity-like token (lt;, gt;, amp;, quot;, apos;). As a result, attacker-supplied input such as <script> is emitted verbatim into the serialized XML rather than being escaped to &lt;script&gt;. When a downstream XML parser later reads the document, it decodes the entity sequences into the literal characters <script>, promoting inert-looking text into real markup. This allows an attacker to bypass upstream filters that block raw < and > characters, injecting markup into any downstream consumer that parses the produced XML and renders the text content in a markup-sensitive context (HTML, SVG, RSS/Atom feeds). Both element text and attribute values are affected.
This issue affects xml_builder: from 0.0.6 before 2.4.1.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.19% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/joshnuss/xml_builder/security/advisories/GHSA-5hjx-8g53-cmvm referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 2.1 | CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N |
| CNA | 4.0 | 2.1 | CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| hex | xml_builder | >=0.0.6, <2.4.1 |
2.4.1 |
Affected products
- joshnuss xml_builder
Classification
- Weakness
-
- CWE-838 Inappropriate Encoding for Output Context
References
-
github.com
/joshnuss/xml_builder/commit/c3390e2046ec297b3bb8c30d5779cdfd6508c275
patch
-
github.com
/joshnuss/xml_builder/security/advisories/GHSA-5hjx-8g53-cmvm
vendor-advisory, related, exploit, advisory
-
cna.erlef.org
/cves/CVE-2026-47079.html
related, web
-
osv.dev
/vulnerability/EEF-CVE-2026-47079
related
-
hex.pm
/packages/xml_builder
package
Sources
- CVE List CVE-2026-47079
- NVD CVE-2026-47079
- OSV EEF-CVE-2026-47079
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.