The xml_builder library by joshnuss contains an XML Injection vulnerability (CWE-91) where element names, attribute names, and doctype identifiers are interpolated directly into XML output without escaping or validation of special XML characters. This allows an attacker who can control these inputs to inject arbitrary XML markup, including extra elements, comments, or event-handler attributes, potentially leading to content spoofing or other injection-based attacks. The vulnerability affects versions from 0.0.1 up to but not including 2.4.1. There is no vendor advisory or patch currently available to address this issue.

An attacker able to influence XML element or attribute names can inject arbitrary XML content into the serialized output. This can result in content spoofing or manipulation of XML documents generated by the library. The CVSS score of 2.1 (low) reflects limited impact and attack complexity, requiring local access or low attack vector. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted input for XML element names, attribute names, or doctype identifiers in xml_builder. Apply input validation or sanitization to prevent injection of special XML characters.