Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-66293— XML comment injection in Saxy encoder via unescaped double hyphen

Quick assessment

Affected
qcam saxy
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Saxy 编码器中存在 XML 注入漏洞。Saxy.Encoder 未能对 XML 注释内容中的 序列进行转义： 函数在所有子句中都原样返回注释二进制数据，仅当注释以单个 结尾时才追加一个空格。因此，无论是注释内部的 还是完整的 ，在编码器将其用 和 分隔符包裹之前，均未被转义或拒绝。 当应用程序通过 或原始简单形式子节点 将攻击者可控的文本序列化为注释时，攻击者可利用 提前关闭注释，从而向序列化后的文档中注入任意同级标记。下游解析器随后会看到应用程序从未构建的元素、属性和文本内容。若该文档被渲染为 HTML 或

CVSS 2.1 · Low

Affected Version Matrix 2

VendorProduct Version RangeStatus
qcam saxy 0.7.0< 1.7.0 affected
7266632e9407842f28ffac254c56dc41210a5690< 6d12ee12b9e32e86ef598b3f3cafccd1840b2f41 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-66293

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
XML comment injection in Saxy encoder via unescaped double hyphen
Source: CVE Program / CVE List V5
Vulnerability Description
XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escape_comment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an interior -- nor a full --> is escaped or rejected before the encoder wraps the content in the <!-- and --> delimiters. When an application serializes attacker-controlled text as a comment, through Saxy.XML.comment/1 or a raw {:comment, text} simple form child, the attacker can close the comment early with --> and inject arbitrary sibling markup into the serialized document. A downstream parser then sees elements, attributes, and text that the application never built. Where the document is rendered as HTML or SVG, the injected markup executes as stored cross-site scripting; where it is consumed by another XML processor, the attacker can forge data that the producing application never emitted. Documents that Saxy only parses are not a vector. This issue affects saxy: from 0.7.0 before 1.7.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
XML注入(XPath盲注)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
qcam saxy 0.7.0 ~ 1.7.0 cpe:2.3:a:qcam:saxy:*:*:*:*:*:*:*:*
qcam saxy 7266632e9407842f28ffac254c56dc41210a5690 ~ 6d12ee12b9e32e86ef598b3f3cafccd1840b2f41 cpe:2.3:a:qcam:saxy:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-66293

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-66293

请登录查看更多情报信息。

Other References for CVE-2026-66293 (5)

Same Patch Batch · qcam · 2026-11-06 · 3 CVEs total

CVE-2026-66295 2.1 LOW Processing instruction target and content emitted unescaped in Saxy encoder allows XML inj
CVE-2026-66294 2.1 LOW XML injection in Saxy via unescaped CDATA section terminator

IV. Related Vulnerabilities

Same product: saxy
Same vendor: qcam
Same weakness: CWE-91