Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-66295— Processing instruction target and content emitted unescaped in Saxy encoder allows XML injection

Quick assessment

Affected

qcam saxy

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Saxy 的 XML 编码器会将处理指令（processing instruction）的目标（target）和内容原样写入输出文档，既未进行验证也未做转义处理。该编码器通过将这两个字段拼接在和之间来构建处理指令结构，因此这两个字段均未受到 XML 规范所施加的约束检查。由于用于终止处理指令，若目标或内容中包含该序列，则会在攻击者指定的位置提前结束该结构。攻击者在该序列之后写入的所有内容都将被作为普通标记（markup）在文档层级输出，从而允许将任意元素、属性以及更多处理指令注入到序列化的文档中。通过追加一

CVSS 2.1 · Low Updated Nov 06, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

Vendor	Product	Version Range	Status
qcam	saxy	`0.7.0< 1.7.0`	affected
		`7266632e9407842f28ffac254c56dc41210a5690< 4aeb80e2acc318f57bd7453ad2eafd59101a90e0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Processing instruction target and content emitted unescaped in Saxy encoder allows XML injection

Source: CVE Program / CVE List V5

Vulnerability Description

Saxy's XML encoder writes the target and the content of a processing instruction into the output document verbatim, without validation or escaping. The encoder builds the construct by concatenating both fields between <? and ?>, so neither field is checked against the constraints the XML specification places on it. Because ?> terminates a processing instruction, a target or content value containing that sequence closes the construct at a position the attacker chooses. Everything the attacker writes after it is emitted as ordinary markup at document level, which allows arbitrary elements, attributes, and further processing instructions to be injected into the serialized document. Appending a matching <? keeps the encoder's own terminator well-formed, so the result still parses and the injection is silent rather than a visible corruption. The target is additionally unconstrained by the XML Name production, which permits injection before the remainder of the processing instruction. The result is XML injection into a serialized document: the tree the application asks Saxy to encode and the tree a downstream parser reads back are no longer the same. Character data, attribute values, and comments are all escaped by the encoder, so processing instructions are the one construct that passes user bytes through untouched. Since Saxy.XML.processing_instruction/2 is a documented public builder, an application inherits the flaw without misusing the API. The consequences depend on what consumes the XML: forged records in a feed or export read by another system, injected stylesheet or rendering directives, or active content where the output is served to a browser as XML or SVG. This issue affects saxy: from 0.7.0 before 1.7.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

XML注入(XPath盲注)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
qcam	saxy	0.7.0 ~ 1.7.0	`cpe:2.3:a:qcam:saxy::::::::`
qcam	saxy	7266632e9407842f28ffac254c56dc41210a5690 ~ 4aeb80e2acc318f57bd7453ad2eafd59101a90e0	`cpe:2.3:a:qcam:saxy::::::::`

II. Public POCs for CVE-2026-66295

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-66295

请登录查看更多情报信息。

Other References for CVE-2026-66295 (5)

https://github.com/qcam/saxy/security/advisories/GHSA-f9r9-vrxq-g566 vendor-advisory related
https://osv.dev/vulnerability/EEF-CVE-2026-66295 related
https://github.com/qcam/saxy/commit/4aeb80e2acc318f57bd7453ad2eafd59101a90e0 patch
https://cna.erlef.org/cves/CVE-2026-66295.html related
https://github.com/qcam/saxy/commit/7266632e9407842f28ffac254c56dc41210a5690 related

https://www.cve.org/CVERecord?id=CVE-2026-66295

Same Patch Batch · qcam · 2026-11-06 · 3 CVEs total

CVE-2026-66294	2.1 LOW	XML injection in Saxy via unescaped CDATA section terminator
CVE-2026-66293	2.1 LOW	XML comment injection in Saxy encoder via unescaped double hyphen

IV. Related Vulnerabilities

Same product: saxy

Same vendor: qcam

Same weakness: CWE-91