Threats affecting pkg:hex/saxy

CVE-2026-66294 is an XML injection vulnerability in the Saxy XML encoder used by the qcam project. The flaw occurs because the encoder's CDATA serialization does not properly handle the substring ]]> inside CDATA sections, allowing an attacker to prematurely terminate the CDATA block and inject arbitrary XML markup. This can lead to forged or overridden XML elements and attributes in documents such as SOAP envelopes, RSS/Atom feeds, sitemaps, SVG, or other XML exports that include untrusted text in CDATA nodes. Versions of saxy from 0.7.0 up to but not including 1.7.0 are affected. The issue is fixed in version 1.7.0.

CVE-2026-66295 is an XML Injection vulnerability in the qcam saxy XML encoder versions from 0.7.0 up to but not including 1.7.0. The vulnerability arises because the encoder writes processing instruction targets and content verbatim without validation or escaping, allowing attackers to inject arbitrary XML constructs. This can cause the serialized XML document to differ from the intended structure, potentially leading to forged records, injected stylesheets, or malicious content in XML or SVG outputs. The issue is fixed in version 1.7.0.

CVE-2026-66293 is an XML injection vulnerability in the Saxy encoder component of the qcam saxy library. The encoder fails to properly neutralize the '--' sequence within XML comment content, allowing an attacker to prematurely close comments and inject arbitrary sibling markup. This can lead to stored cross-site scripting (XSS) when rendered as HTML or SVG, or data forgery when processed by other XML consumers. The vulnerability affects saxy versions from 0.7.0 up to but not including 1.7.0. A fix is available starting from version 1.7.0.