Threat Intelligence Database

CVE-2026-47079 is a vulnerability in the joshnuss xml_builder library where certain characters are not properly escaped in XML output. This allows attacker-supplied input containing entity-like tokens to be emitted verbatim, potentially leading to content spoofing or cross-site scripting when downstream XML parsers decode the entities. The issue affects versions from 0.0.6 up to but not including 2.4.1.

CVE-2026-48590 is an XML Injection vulnerability in the joshnuss xml_builder library affecting versions from 0.0.1 up to but not including 2.4.1. The vulnerability arises because element names, attribute names, and doctype identifiers are inserted into XML output without proper validation or escaping of special characters. This allows an attacker who can control these inputs to inject arbitrary XML markup, potentially leading to content spoofing or manipulation of the XML document structure. The CVSS score is low (2.1), indicating limited impact and attack complexity.

CVE-2026-47080 is an XML Injection vulnerability in the joshnuss xml_builder library affecting versions from 0.0.7 up to but not including 2.4.1. The flaw arises because the escape/1 function does not properly handle embedded CDATA section terminators (]]>) in user-supplied input, allowing an attacker to prematurely close CDATA sections and inject arbitrary XML content. This can lead to content spoofing and XML injection attacks. The vulnerability has a low CVSS 4.0 score of 2.1, indicating limited impact and complexity.