EEF-CVE-2026-47080 CDATA Section Breakout via Unsanitised ]]> in xml_builder

Summary XML Injection vulnerability in joshnuss xmlbuilder XmlBuilder module allows Content Spoofing, XML Injection. This vulnerability is associated with program files lib/xmlbuilder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape/1. The escape/1 clause fo...

CVE-2026-47080 CDATA Section Breakout via Unsanitised ]]> in xml_builder

XML Injection vulnerability in joshnuss xmlbuilder XmlBuilder module allows Content Spoofing, XML Injection. This vulnerability is associated with program files lib/xmlbuilder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape/1. The escape/1 clause for :cdata...

CVE-2026-47080 CDATA Section Breakout via Unsanitised ]]> in xml_builder

XML Injection vulnerability in joshnuss xmlbuilder XmlBuilder module allows Content Spoofing, XML Injection. This vulnerability is associated with program files lib/xmlbuilder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape/1. The escape/1 clause for :cdata...

CVE-2026-47080

CVE-2026-47080 is an XML Injection vulnerability in the joshnuss xml_builder Elixir library (versions 0.0.7 through before 2.4.1 ). The root cause is in XmlBuilder.escape/1 within lib/xml_builder.ex: when handling {:cdata, data}, the data is placed verbatim between without splitting on embedded ...