The vulnerability in joshnuss xml_builder (XmlBuilder module) is due to improper handling of CDATA sections in the escape/1 function. Specifically, the function concatenates data verbatim between <![CDATA[ and ]]> without splitting on embedded ]]> sequences. Since CDATA sections cannot internally escape ]]> sequences, an attacker supplying input containing ]]> can prematurely close the CDATA section. This causes subsequent input to be interpreted as XML markup, enabling injection of arbitrary elements, text, or entity references into the generated XML document. This affects xml_builder versions from 0.0.7 up to but not including 2.4.1.

An attacker able to supply input containing the ]]> sequence can inject arbitrary XML content into documents generated by xml_builder, potentially leading to content spoofing or manipulation of XML data. The impact is limited by the low CVSS score (2.1) and the requirement for local access (attack vector: local). There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is documented, users should monitor vendor communications for updates. Avoid processing untrusted input containing CDATA sections or the ]]> sequence until a fix is available.