CVE-2026-47080: CWE-91 XML Injection (aka Blind XPath Injection) in joshnuss xml_builder

The vulnerability in joshnuss xml_builder (XmlBuilder module) occurs in the escape/1 clause handling {:cdata, data} in lib/xml_builder.ex. It concatenates data verbatim between <![CDATA[ and ]]> without splitting on embedded ]]> sequences. Since CDATA sections cannot internally escape ]]> sequences, an attacker supplying input containing ]]> can prematurely close the CDATA section. Subsequent bytes are parsed as normal XML markup, enabling injection of arbitrary elements, text, or entity references into the output XML document. This affects versions >=0.0.7 and <2.4.1.

An attacker able to supply crafted input containing ]]> can inject arbitrary XML content into documents generated by the xml_builder library. This can lead to content spoofing or manipulation of XML data processed by downstream consumers. The impact is limited by the low CVSS score and the requirement for local access (attack vector: local). There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid including untrusted input containing CDATA terminators (]]>) in XML generated by xml_builder. Consider sanitizing or rejecting such input to prevent injection. Monitor vendor channels for updates or patches addressing this issue.