Threats tagged 'ghsa-w2hc-m8qc-7hgm'

CVE-2026-66294 is an XML injection vulnerability in the Saxy XML encoder affecting versions from 0.7.0 before 1.7.0. The vulnerability arises because the encoder's CDATA serialization does not properly handle the ]]> substring, allowing attackers to prematurely terminate CDATA sections and inject arbitrary XML markup. This can lead to forged or overridden trusted fields in XML documents such as SOAP envelopes, RSS/Atom feeds, sitemaps, SVG, or other XML exports that include untrusted text in CDATA nodes. Applications that do not place untrusted text in CDATA nodes are not affected. The CVSS score is low (2.1).