CVE-2026-66294

XML injection in the Saxy XML encoder. Saxy.Encoder.cdata/1 serializes a :cdata, characters node by wrapping the supplied characters between and passing the payload through byte for byte. The encoder's character-data and attribute-value paths escape the XML metacharacters , &, ", and ', but the...

CVE-2026-66293

XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escapecomment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an interior -- nor a full -- is escaped or...

EEF-CVE-2026-66294 XML injection in Saxy via unescaped CDATA section terminator

Summary XML injection in the Saxy XML encoder. Saxy.Encoder.cdata/1 serializes a :cdata, characters node by wrapping the supplied characters between and passing the payload through byte for byte. The encoder's character-data and attribute-value paths escape the XML metacharacters , &, ", and ', b...

CVE-2026-66294

The saxy XML encoder (versions 0.7.0 before 1.7.0 ) is vulnerable to XML injection because Saxy.Encoder.cdata/1 fails to neutralize the ]]> substring. While other paths escape XML metacharacters, the CDATA path passes the payload byte for byte, allowing an attacker who can provide untrusted te...

CVE-2026-66294 XML injection in Saxy via unescaped CDATA section terminator

XML injection in the Saxy XML encoder. Saxy.Encoder.cdata/1 serializes a :cdata, characters node by wrapping the supplied characters between and passing the payload through byte for byte. The encoder's character-data and attribute-value paths escape the XML metacharacters , &, ", and ', but the...

EUVD-2026-118039

XML injection in the Saxy XML encoder. Saxy.Encoder.cdata/1 serializes a :cdata, characters node by wrapping the supplied characters between and passing the payload through byte for byte. The encoder's character-data and attribute-value paths escape the XML metacharacters , &, ", and ', but the...

EUVD-2026-118038

Saxy's XML encoder writes the target and the content of a processing instruction into the output document verbatim, without validation or escaping. The encoder builds the construct by concatenating both fields between , so neither field is checked against the constraints the XML specification...

EEF-CVE-2026-66295 Processing instruction target and content emitted unescaped in Saxy encoder allows XML injection

Summary Saxy's XML encoder writes the target and the content of a processing instruction into the output document verbatim, without validation or escaping. The encoder builds the construct by concatenating both fields between , so neither field is checked against the constraints the XML...

CVE-2026-66295

The saxy XML encoder (versions 0.7.0 before 1.7.0 ) is vulnerable to XML injection because it writes the target and content of a processing instruction verbatim without validation or escaping. By including the sequence ?> in a target or content value, an attacker can prematurely terminate the ...

CVE-2026-66295 Processing instruction target and content emitted unescaped in Saxy encoder allows XML injection

Saxy's XML encoder writes the target and the content of a processing instruction into the output document verbatim, without validation or escaping. The encoder builds the construct by concatenating both fields between , so neither field is checked against the constraints the XML specification...

EEF-CVE-2026-66293 XML comment injection in Saxy encoder via unescaped double hyphen

Summary XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escapecomment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an interior -- nor a full -- is...

CVE-2026-66293

The Saxy library (versions 0.7.0 before 1.7.0 ) is vulnerable to XML injection because the Saxy.Encoder fails to neutralize the -- sequence within XML comments. Specifically, the escape_comment/2 function fails to escape interior -- or full --> sequences, allowing an attacker to prematurely cl...

EUVD-2026-118185

XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escapecomment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an interior -- nor a full -- is escaped or...

CVE-2026-66295: qcam saxy: Saxy's XML encoder writes the target and the content of a processing instruction into the output document verbatim,…

Saxy's XML encoder writes the target and the content of a processing instruction into the output document verbatim, without validation or escaping. The encoder builds the construct by concatenating both fields between and ?, so neither field is checked against the constraints the XML specificatio...

CVE-2026-66293: qcam saxy: XML injection in the encoder of Saxy

XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escapecomment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an interior -- nor a full -- is escaped or...

CVE-2026-66294: qcam saxy: XML injection in the Saxy XML encoder

XML injection in the Saxy XML encoder. Saxy.Encoder.cdata/1 serializes a :cdata, characters node by wrapping the supplied characters between and passing the payload through byte for byte. The encoder's character-data and attribute-value paths escape the XML metacharacters , &, ", and ', but the...