CVE-2026-48590: Element and Attribute Names Injected Verbatim into XML Output in xml_builder
XML Injection vulnerability in joshnuss xmlbuilder (XmlBuilder module) allows Content Spoofing, XML Injection.
This vulnerability is associated with program files lib/xmlbuilder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.element/1, XmlBuilder.element/2, XmlBuilder.element/3.
Element names, attribute names, and doctype identifiers are interpolated verbatim into the serialized XML output without validation or escaping of structural characters (<, >, ", ', &). An attacker who can influence a name argument (for example, an element name derived from a JSON object key or an HTTP form field name) can inject arbitrary XML markup including extra elements, comments, and event-handler attributes into the output document.
This issue affects xmlbuilder: from 0.0.1 before 2.4.1.
Affected Software
Event History
Frequently Asked Questions
Which applications are realistically exposed to this issue?
Applications using xml_builder versions from 0.0.1 through versions before 2.4.1 are exposed when untrusted input can influence XML element names, attribute names, or doctype identifiers. Examples include names derived from JSON object keys or HTTP form field names.
What does an attacker need to exploit the vulnerability?
An attacker needs control over a value passed as an element name, attribute name, or doctype identifier. Structural characters in that value can then be serialized verbatim, allowing injection of XML markup such as additional elements, comments, or event-handler attributes.
Are ordinary XML text values enough to trigger this issue?
The described issue concerns XML names and doctype identifiers, not ordinary element content or attribute values. Exploitation requires attacker influence over a name argument used by XmlBuilder.generate/1, XmlBuilder.generate/2, or XmlBuilder.element/1, XmlBuilder.element/2, or XmlBuilder.element/3.
What can be done if upgrading is not immediately possible?
Do not pass untrusted data into element names, attribute names, or doctype identifiers. Validate such identifiers against an allowlist of expected XML-safe names before supplying them to xml_builder.