The vulnerability in joshnuss xml_builder (CVE-2026-47079) arises from inappropriate encoding for output context (CWE-838) in the XmlBuilder.generate/1 function and related routines. The function does not properly escape '&' characters when followed by entity-like tokens (e.g., lt;, gt;, amp;, quot;, apos;), causing attacker-supplied input such as <script> to be included verbatim in serialized XML. When downstream XML parsers decode these entities, the text is interpreted as real markup, enabling injection of malicious markup into any downstream consumer that parses and renders the XML. Both element text and attribute values are affected. This vulnerability affects xml_builder versions from 0.0.6 up to 2.4.1.

An attacker can inject malicious markup into XML documents generated by the vulnerable xml_builder versions, potentially leading to content spoofing and cross-site scripting (XSS) in applications that parse and render the XML output in markup-sensitive contexts such as HTML, SVG, or RSS/Atom feeds. The vulnerability allows bypassing upstream filters that block raw '<' and '>' characters by exploiting improper escaping of entity-like sequences. However, the CVSS score is low (2.1), indicating limited impact or exploitability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, users should consider applying manual input validation or escaping on data before passing it to xml_builder, or avoid using affected versions in security-sensitive contexts. Monitor vendor channels for updates regarding an official fix.