Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-47079— Round-trip Corruption via Improper Entity Escaping in xml_builder

Quick assessment

Affected
joshnuss xml_builder
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Joshua Nussbaum XML Builder是Joshua Nussbaum个人开发者的一款构建XML文档的软件工具。 Joshua Nussbaum XML Builder 0.0.6至2.4.1之前版本存在输出处理不当漏洞，该漏洞源于不适当的输出上下文编码，XmlBuilder.generate/1未对文本或属性值中后跟实体标记的&字符进行转义，可能导致内容欺骗和跨站脚本攻击。

CVSS 2.1 · Low EPSS 0.19% · P8

Affected Version Matrix 2

VendorProduct Version RangeStatus
joshnuss xml_builder 0.0.6< 2.4.1 affected
aae31e6e8ac837bcbb8afb816c0d14324b5cfe2b< c3390e2046ec297b3bb8c30d5779cdfd6508c275 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-47079

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Round-trip Corruption via Improper Entity Escaping in xml_builder
Source: CVE Program / CVE List V5
Vulnerability Description
Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, Cross-site Scripting. This vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape_string/1, XmlBuilder.escape_entity/1. XmlBuilder.generate/1 does not escape literal & characters in text or attribute values when they are followed by an entity-like token (lt;, gt;, amp;, quot;, apos;). As a result, attacker-supplied input such as &lt;script&gt; is emitted verbatim into the serialized XML rather than being escaped to &amp;lt;script&amp;gt;. When a downstream XML parser later reads the document, it decodes the entity sequences into the literal characters <script>, promoting inert-looking text into real markup. This allows an attacker to bypass upstream filters that block raw < and > characters, injecting markup into any downstream consumer that parses the produced XML and renders the text content in a markup-sensitive context (HTML, SVG, RSS/Atom feeds). Both element text and attribute values are affected. This issue affects xml_builder: from 0.0.6 before 2.4.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
输出上下文语义编码不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Joshua Nussbaum XML Builder 输出处理不当漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Joshua Nussbaum XML Builder是Joshua Nussbaum个人开发者的一款构建XML文档的软件工具。 Joshua Nussbaum XML Builder 0.0.6至2.4.1之前版本存在输出处理不当漏洞，该漏洞源于不适当的输出上下文编码，XmlBuilder.generate/1未对文本或属性值中后跟实体标记的&字符进行转义，可能导致内容欺骗和跨站脚本攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
joshnuss xml_builder 0.0.6 ~ 2.4.1 cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*
joshnuss xml_builder aae31e6e8ac837bcbb8afb816c0d14324b5cfe2b ~ c3390e2046ec297b3bb8c30d5779cdfd6508c275 cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-47079

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-47079

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-47079 (1)

Vendor Advisories for CVE-2026-47079 (2)

News Coverage for CVE-2026-47079 (1)

Same Patch Batch · joshnuss · 2026-08-21 · 3 CVEs total

CVE-2026-47080 2.1 LOW CDATA Section Breakout via Unsanitised ]]> in xml_builder
CVE-2026-48590 2.1 LOW Element and Attribute Names Injected Verbatim into XML Output in xml_builder

IV. Related Vulnerabilities

Same product: xml_builder
Same vendor: joshnuss
Same weakness: CWE-838

V. Comments for CVE-2026-47079

No comments yet

Leave a comment