Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-66294— XML injection in Saxy via unescaped CDATA section terminator

Quick assessment

Affected
qcam saxy
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Saxy XML 编码器中存在 XML 注入漏洞。Saxy.Encoder.cdata/1 函数在序列化 节点时，会将提供的字符包裹在 和 之间，并按字节逐字传递载荷。该编码器的字符数据路径和属性值路径会对 XML 元字符 、 、 、 和 进行转义，但 CDATA 路径完全未进行任何中和处理。由于 XML 标准在 CDATA 节内部不提供字符转义机制，因此唯一正确表示 子串的方法是将其拆分，并重组为 。然而，Saxy 既未执行该拆分操作，也未拒绝包含该子串的输入。 若某个应用程序通过调用 构建节点，并使用 或 将不

CVSS 2.1 · Low

Affected Version Matrix 2

VendorProduct Version RangeStatus
qcam saxy 0.7.0< 1.7.0 affected
7266632e9407842f28ffac254c56dc41210a5690< 71d99fae12f1d6596f5edb57b71f26ba854f4d33 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-66294

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
XML injection in Saxy via unescaped CDATA section terminator
Source: CVE Program / CVE List V5
Vulnerability Description
XML injection in the Saxy XML encoder. Saxy.Encoder.cdata/1 serializes a {:cdata, characters} node by wrapping the supplied characters between <![CDATA[ and ]]> and passing the payload through byte for byte. The encoder's character-data and attribute-value paths escape the XML metacharacters <, >, &, ", and ', but the CDATA path applies no neutralization at all. XML provides no character escaping mechanism inside a CDATA section, so the only correct way to represent a ]]> substring is to split the section and rejoin it as ]]]]><![CDATA[>. Saxy neither performs that split nor rejects the substring. An application that renders untrusted text as CDATA, by building the node with Saxy.XML.cdata/1 and serializing it with Saxy.encode!/2 or Saxy.encode_to_iodata!/2, therefore lets an attacker terminate the section at a position of their choosing. Everything supplied after the ]]> is emitted outside any CDATA context and is parsed as markup, so a single attacker-controlled text field becomes attacker-controlled document structure: arbitrary sibling elements and attributes that the application never built. Downstream consumers of the serialized document accept the injected markup as genuine. Services that generate SOAP envelopes, RSS or Atom feeds, sitemaps, SVG, or XML exports from user-supplied content can have trusted fields forged or overridden. Applications that never place untrusted text in a CDATA node are not affected. This issue affects saxy: from 0.7.0 before 1.7.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
XML注入(XPath盲注)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
qcam saxy 0.7.0 ~ 1.7.0 cpe:2.3:a:qcam:saxy:*:*:*:*:*:*:*:*
qcam saxy 7266632e9407842f28ffac254c56dc41210a5690 ~ 71d99fae12f1d6596f5edb57b71f26ba854f4d33 cpe:2.3:a:qcam:saxy:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-66294

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-66294

请登录查看更多情报信息。

Other References for CVE-2026-66294 (5)

Same Patch Batch · qcam · 2026-11-06 · 3 CVEs total

CVE-2026-66295 2.1 LOW Processing instruction target and content emitted unescaped in Saxy encoder allows XML inj
CVE-2026-66293 2.1 LOW XML comment injection in Saxy encoder via unescaped double hyphen

IV. Related Vulnerabilities

Same product: saxy
Same vendor: qcam
Same weakness: CWE-91