CVE-2026-66293 in Saxy
Summary
by MITRE • 11/06/2026
XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escape_comment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an interior -- nor a full --> is escaped or rejected before the encoder wraps the content in the <!-- and --> delimiters.
When an application serializes attacker-controlled text as a comment, through Saxy.XML.comment/1 or a raw {:comment, text} simple form child, the attacker can close the comment early with --> and inject arbitrary sibling markup into the serialized document. A downstream parser then sees elements, attributes, and text that the application never built. Where the document is rendered as HTML or SVG, the injected markup executes as stored cross-site scripting; where it is consumed by another XML processor, the attacker can forge data that the producing application never emitted. Documents that Saxy only parses are not a vector.
This issue affects saxy: from 0.7.0 before 1.7.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified in the Saxy library represents a critical XML injection flaw rooted in improper neutralization of special elements within comment content. Specifically, the encoder function escape_comment/2 fails to properly sanitize sequences such as double hyphens (--). In standard XML syntax, comments are delimited by <!-- and -->, and any occurrence of -- inside a comment is technically invalid according to the XML specification. However, Saxy.Encoder does not reject or escape these internal delimiters; instead, it returns the binary content unchanged unless the comment ends with a single hyphen, in which case it merely appends a space. This oversight allows an attacker who controls the input text for a comment node to inject arbitrary markup by closing the comment prematurely using --> and appending malicious sibling elements or attributes that are then serialized into the final document structure.
From a technical perspective, this flaw enables what is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) when the output context involves HTML or SVG rendering, and CWE-142 in broader XML contexts where untrusted data influences code execution paths. The vulnerability arises because the application serializes attacker-controlled text directly into a comment node without validating that the content does not contain sequences capable of breaking out of the comment scope. When this malformed document is processed by downstream parsers or rendered in browsers, the injected markup is interpreted as active elements rather than inert comment data. This leads to scenarios where stored cross-site scripting can occur if the output is served as HTML or SVG, allowing attackers to execute scripts in the context of the victim’s browser session.
The operational impact extends beyond client-side attacks. In systems that consume XML documents for further processing, such as enterprise integration platforms or API backends, this vulnerability allows data forgery and logic bypasses. An attacker can inject elements, attributes, or text nodes that were never intended by the application developer, potentially altering business logic, exfiltrating sensitive information through error messages, or causing denial of service if the injected content disrupts parsing expectations. It is important to note that this vulnerability only affects documents produced by Saxy; documents merely parsed by Saxy are not vulnerable vectors since no serialization occurs in those cases. The issue impacts versions from 0.7.0 up to but not including version 1.7.0, highlighting the need for immediate patching or mitigation strategies in affected environments.
Mitigation requires both short-term workarounds and long-term architectural fixes. Developers should immediately upgrade Saxy to version 1.7.0 or later where this encoding flaw has been addressed. For systems unable to update promptly, input validation must be implemented at the application layer before passing data to the encoder. This includes stripping or escaping double hyphens within comment content and ensuring that any user-supplied text intended for comments is strictly validated against a whitelist of allowed characters if possible. Additionally, output encoding should follow strict context-aware rules as recommended by OWASP guidelines, particularly when dealing with XML-based interfaces. Security teams should also monitor logs for unusual patterns in serialized documents containing malformed comment structures to detect potential exploitation attempts early.
This vulnerability aligns with ATT&CK technique T1059: Command and Scripting Interpreter if exploited via stored XSS leading to script execution, or T1136: Create Account if used to forge administrative tokens within XML-based authentication flows. Understanding these mappings helps in prioritizing remediation efforts based on the specific attack surface exposed by each deployment environment. By addressing this encoding deficiency, organizations can prevent attackers from manipulating document structure and ensure that serialized data remains faithful to its intended semantic meaning without introducing executable or exploitable side effects.