EEF-CVE-2026-66293 XML comment injection in Saxy encoder via unescaped double hyphen

Summary XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escapecomment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an interior -- nor a full -- is...

CVE-2026-66293

The Saxy library (versions 0.7.0 before 1.7.0 ) is vulnerable to XML injection because the Saxy.Encoder fails to neutralize the -- sequence within XML comments. Specifically, the escape_comment/2 function fails to escape interior -- or full --> sequences, allowing an attacker to prematurely cl...

EUVD-2026-118185

XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escapecomment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an interior -- nor a full -- is escaped or...