CVE-2026-48590: CWE-91 XML Injection (aka Blind XPath Injection) in joshnuss xml_builder

The vulnerability in the XmlBuilder module of joshnuss xml_builder (CVE-2026-48590) stems from unsafe interpolation of XML structural characters in element names, attribute names, and doctype identifiers within the serialization routines (XmlBuilder.generate/1, generate/2, element/1, element/2, element/3). This lack of escaping or validation enables an attacker controlling input names to inject arbitrary XML markup such as additional elements, comments, or event-handler attributes. The affected versions are >=0.0.1 and <2.4.1.

An attacker able to influence element or attribute names in XML output can inject arbitrary XML content, which may lead to content spoofing or manipulation of the XML document. The impact is limited by the low CVSS score (2.1) and the requirement for local or limited access (attack vector local). There is no indication of remote exploitation or privilege escalation.

No official patch or fix is indicated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted input directly as element or attribute names in XML generation or apply manual validation and escaping of XML structural characters in these inputs.