{"id":"CVE-2026-47080","summary":"CDATA Section Breakout via Unsanitised ]]\u003e in xml_builder","details":"XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection.\n\nThis vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape/1.\n\nThe escape/1 clause for {:cdata, data} in lib/xml_builder.ex concatenates data verbatim between the CDATA opener \u003c![CDATA[ and closer ]]\u003e without rewriting or splitting on the embedded ]]\u003e sequence. Because CDATA sections have no internal escape mechanism, the only safe way to embed arbitrary bytes is to split on ]]\u003e and emit adjacent CDATA sections. An attacker who can supply input containing ]]\u003e closes the CDATA section early; any bytes that follow are parsed as ordinary XML markup by downstream consumers, allowing injection of arbitrary elements, text, or entity references into the output document.\n\nThis issue affects xml_builder: from 0.0.7 before 2.4.1.","aliases":["EEF-CVE-2026-47080","GHSA-67r9-hmxw-h595"],"modified":"2026-08-27T11:31:12.314258069Z","published":"2026-08-21T09:49:34.772Z","database_specific":{"cna_assigner":"EEF","cwe_ids":["CWE-91"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47080.json","unresolved_ranges":[{"extracted_events":[{"introduced":"0.0.7"},{"fixed":"2.4.1"},{"introduced":"26766f884ed19adee1563522c7afb5f056a6f3b5"},{"fixed":"bfb1ada071ccc1e384c30f782197ca5154106706"}],"source":"AFFECTED_FIELD"},{"extracted_events":[{"introduced":"0.0.7"},{"fixed":"2.4.1"}],"source":"CPE_FIELD"},{"extracted_events":[{"introduced":"0.0.7"},{"fixed":"2.4.1"}],"source":"DESCRIPTION"}]},"references":[{"type":"WEB","url":"https://cna.erlef.org/cves/CVE-2026-47080.html"},{"type":"WEB","url":"https://github.com"},{"type":"WEB","url":"https://osv.dev/vulnerability/EEF-CVE-2026-47080"},{"type":"WEB","url":"https://repo.hex.pm"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47080.json"},{"type":"ADVISORY","url":"https://github.com/joshnuss/xml_builder/security/advisories/GHSA-67r9-hmxw-h595"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47080"},{"type":"FIX","url":"https://github.com/joshnuss/xml_builder/commit/bfb1ada071ccc1e384c30f782197ca5154106706"},{"type":"PACKAGE","url":"https://github.com/joshnuss/xml_builder"},{"type":"EVIDENCE","url":"https://vincent.vulcoord.net/score/?state=Not+Scored&year=2026&year=2025&assigned_to=88bc49d9-8ddd-4227-affc-a613e67abc4d&ordering=-published&cve=CVE-2026-47080"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/joshnuss/xml_builder","events":[{"introduced":"0"},{"fixed":"bfb1ada071ccc1e384c30f782197ca5154106706"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v0.0.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47080.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N"}]}