Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-47079— Round-trip Corruption via Improper Entity Escaping in xml_builder

Quick assessment

Affected
joshnuss xml_builder
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

joshnuss xml_builder（XmlBuilder 模块）中存在一种“输出上下文编码不当”漏洞，可导致内容欺骗（Content Spoofing）和跨站脚本攻击（XSS）。 该漏洞与程序文件 以及相关程序例程 、 、 和 相关。 在文本或属性值中遇到字面量 字符时，如果其后跟随的是类似实体的令牌（如 、 、 、 、 ），则不会对其进行转义。因此，攻击者提供的输入（例如 ）会被原样输出到序列化的 XML 中，而不是被转义为 。当下游 XML 解析器读取该文档时，会将这些实体序列解码为字面量字符 ，从而使看

CVSS 2.1 · Low EPSS 0.14% · P4

Affected Version Matrix 2

VendorProduct Version RangeStatus
joshnuss xml_builder 0.0.6< 2.4.1 affected
aae31e6e8ac837bcbb8afb816c0d14324b5cfe2b< c3390e2046ec297b3bb8c30d5779cdfd6508c275 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-47079

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Round-trip Corruption via Improper Entity Escaping in xml_builder
Source: CVE Program / CVE List V5
Vulnerability Description
Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, Cross-site Scripting. This vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape_string/1, XmlBuilder.escape_entity/1. XmlBuilder.generate/1 does not escape literal & characters in text or attribute values when they are followed by an entity-like token (lt;, gt;, amp;, quot;, apos;). As a result, attacker-supplied input such as &lt;script&gt; is emitted verbatim into the serialized XML rather than being escaped to &amp;lt;script&amp;gt;. When a downstream XML parser later reads the document, it decodes the entity sequences into the literal characters <script>, promoting inert-looking text into real markup. This allows an attacker to bypass upstream filters that block raw < and > characters, injecting markup into any downstream consumer that parses the produced XML and renders the text content in a markup-sensitive context (HTML, SVG, RSS/Atom feeds). Both element text and attribute values are affected. This issue affects xml_builder: from 0.0.6 before 2.4.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
输出上下文语义编码不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
joshnuss xml_builder 0.0.6 ~ 2.4.1 cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*
joshnuss xml_builder aae31e6e8ac837bcbb8afb816c0d14324b5cfe2b ~ c3390e2046ec297b3bb8c30d5779cdfd6508c275 cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-47079

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-47079

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-47079 (1)

Vendor Advisories for CVE-2026-47079 (2)

News Coverage for CVE-2026-47079 (1)

Same Patch Batch · joshnuss · 2026-08-21 · 3 CVEs total

CVE-2026-47080 2.1 LOW CDATA Section Breakout via Unsanitised ]]> in xml_builder
CVE-2026-48590 2.1 LOW Element and Attribute Names Injected Verbatim into XML Output in xml_builder

IV. Related Vulnerabilities

Same product: xml_builder
Same vendor: joshnuss
Same weakness: CWE-838

V. Comments for CVE-2026-47079

No comments yet

Leave a comment