joshnuss xml_builder 0.0.1/2.4.0 XmlBuilder lib/xml_builder.ex XmlBuilder.generate/XmlBuilder.element Name xml injection

Summaryinfo

A vulnerability categorized as critical has been discovered in joshnuss xml_builder 0.0.1/2.4.0. Impacted is the function XmlBuilder.generate/XmlBuilder.element of the file lib/xml_builder.ex of the component XmlBuilder. The manipulation of the argument Name results in xml injection. This vulnerability is known as CVE-2026-48590. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in joshnuss xml_builder 0.0.1/2.4.0. It has been classified as critical. Affected is the function XmlBuilder.generate/XmlBuilder.element of the file lib/xml_builder.ex of the component XmlBuilder. The manipulation of the argument name with an unknown input leads to a xml injection vulnerability. CWE is classifying the issue as CWE-91. The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection. This vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.element/1, XmlBuilder.element/2, XmlBuilder.element/3. Element names, attribute names, and doctype identifiers are interpolated verbatim into the serialized XML output without validation or escaping of structural characters (<, >, ", ', &). An attacker who can influence a name argument (for example, an element name derived from a JSON object key or an HTTP form field name) can inject arbitrary XML markup including extra elements, comments, and event-handler attributes into the output document. This issue affects xml_builder: from 0.0.1 before 2.4.1.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-48590 since 05/22/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1505.

Upgrading to version 2.4.1 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• joshnuss

Name

• xml_builder

Version

• 0.0.1
• 2.4.0

Website

• Product: https://github.com/joshnuss/xml_builder/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion