Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, Cross-site Scripting. This vulnerability is associated with program files…
Info
Summary
Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, Cross-site Scripting. This vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape_string/1, XmlBuilder.escape_entity/1. XmlBuilder.generate/1 does not escape literal & characters in text or attribute values when they are followed by an entity-like token (lt;, gt;, amp;, quot;…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://cna.erlef.org/cves/CVE-2026-47079.html
- https://github.com/joshnuss/xml_builder/commit/c3390e2046ec297b3bb8c30d5779cdfd6508c275
- https://github.com/joshnuss/xml_builder/security/advisories/GHSA-5hjx-8g53-cmvm
- https://osv.dev/vulnerability/EEF-CVE-2026-47079
Timeline
- nvd_ingest NVD