CVE-2026-66294

The saxy XML encoder (versions 0.7.0 before 1.7.0 ) is vulnerable to XML injection because Saxy.Encoder.cdata/1 fails to neutralize the ]]> substring. While other paths escape XML metacharacters, the CDATA path passes the payload byte for byte, allowing an attacker who can provide untrusted te...

EUVD-2026-118039

XML injection in the Saxy XML encoder. Saxy.Encoder.cdata/1 serializes a :cdata, characters node by wrapping the supplied characters between and passing the payload through byte for byte. The encoder's character-data and attribute-value paths escape the XML metacharacters , &, ", and ', but the...

EUVD-2026-118038

Saxy's XML encoder writes the target and the content of a processing instruction into the output document verbatim, without validation or escaping. The encoder builds the construct by concatenating both fields between , so neither field is checked against the constraints the XML specification...

CVE-2026-66295

The saxy XML encoder (versions 0.7.0 before 1.7.0 ) is vulnerable to XML injection because it writes the target and content of a processing instruction verbatim without validation or escaping. By including the sequence ?> in a target or content value, an attacker can prematurely terminate the ...

EEF-CVE-2026-66293 XML comment injection in Saxy encoder via unescaped double hyphen

Summary XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escapecomment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an interior -- nor a full -- is...

CVE-2026-66293

The Saxy library (versions 0.7.0 before 1.7.0 ) is vulnerable to XML injection because the Saxy.Encoder fails to neutralize the -- sequence within XML comments. Specifically, the escape_comment/2 function fails to escape interior -- or full --> sequences, allowing an attacker to prematurely cl...

EUVD-2026-118185

XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escapecomment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an interior -- nor a full -- is escaped or...