CVE-2026-53723 is an improper input validation vulnerability in guzzle-services prior to version 1.5.3. The XML request serializer uses CDATA sections to write values containing special characters, but does not safely handle embedded CDATA terminators ']]>'. If attacker-controlled input includes ']]>', the CDATA section closes prematurely, and the remainder is interpreted as XML markup, allowing injection of attacker-controlled elements into outgoing XML requests. This affects applications using guzzlehttp/guzzle-services to serialize outgoing requests with parameters or additionalParameters located in XML element text (not attributes), where the input is untrusted and unconstrained. The vulnerability can lead to altered operation semantics, smuggling of privileged fields, or conflicting duplicated elements in downstream services that parse the XML structurally. The vulnerability is patched in version 1.5.3 and later by splitting embedded CDATA terminators before serialization, preserving the original scalar value as XML text and preventing injection. Workarounds include constraining input to exclude ']]>' or avoiding serialization of untrusted data into XML element text until patched.

The vulnerability allows an attacker controlling input serialized into XML element text to inject additional XML elements into outgoing requests by prematurely closing CDATA sections. This can alter the semantics of operations performed by downstream services, potentially smuggling privileged fields, bypassing parameter boundaries, or creating conflicting duplicated elements. There is no direct impact on confidentiality or availability, but integrity of outgoing XML request bodies can be compromised. The vulnerability does not affect response parsing unless attacker-controlled response data is later reused in requests. The CVSS 3.1 base score is 5.8 (medium severity) reflecting network attack vector, low complexity, no privileges required, no user interaction, scope change, no confidentiality impact, limited integrity impact, and no availability impact.

A fix is available in guzzle-services version 1.5.3 and later, which safely handles embedded CDATA terminators to prevent injection. Users should upgrade to version 1.5.3 or newer. As a workaround before patching, constrain attacker-controlled XML element values with strict enums, patterns, or custom filters that exclude the CDATA terminator sequence ']]>', or avoid serializing untrusted input into XML element text parameters with location: xml. Review service descriptions for parameters using location: xml to identify affected areas. XML attributes are not affected by this issue. No action is required if only response deserialization is used without subsequent request serialization of untrusted data.