Threats tagged 'ghsa-7h52-pqgv-pcwc'

CVE-2026-66293 is an XML injection vulnerability in the encoder component of the Saxy library. The encoder fails to properly neutralize the '--' sequence within XML comment content, allowing an attacker to prematurely close comments and inject arbitrary sibling markup. This can lead to stored cross-site scripting (XSS) when rendered as HTML or SVG, or data forgery when processed by other XML consumers. The vulnerability affects Saxy versions from 0.7.0 up to but not including 1.7.0.