Saxy's XML encoder has a vulnerability where processing instructions are written verbatim without validation or escaping. This allows an attacker to inject arbitrary XML elements, attributes, or further processing instructions by manipulating the target or content fields. The flaw affects versions from 0.7.0 up to but not including 1.7.0. The impact depends on how the XML output is consumed, potentially leading to forged records, injected stylesheets, or active content execution in browsers. The CVSS score is low, reflecting limited impact and complexity.