CVE-2026-47080: xml_builder CDATA Section Breakout Vulnerability
Summary
CVE-2026-47080: CDATA Section Breakout via Unsanitised ]]> in xml_builder. Affects xml_builder across 2 version ranges.
>= 0.0.7, < 2.4.1
>= 26766f884ed19adee1563522c7afb5f056a6f3b5, < bfb1ada071ccc1e384c30f782197ca5154106706
Fixed in 2.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The xml_builder package, developed by Josh Nussbaum, is an Elixir library designed for generating XML documents. It provides a simple and efficient way to create XML structures programmatically. However, it is vulnerable to an XML Injection issue that can lead to content spoofing and unauthorized XML markup injection.
Vulnerability Detail
The vulnerability arises from the escape/1 function in the xml_builder library, which fails to properly handle the CDATA section closing sequence (]]>). When an attacker provides input containing this sequence, it prematurely closes the CDATA section, allowing the injection of arbitrary XML markup. This can lead to significant security risks, including content spoofing and unauthorized data manipulation in the generated XML documents.
How To Fix
Minimum fixed version
2.4.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using user-supplied data directly within CDATA sections. Instead, sanitize the input or split the data into multiple CDATA sections to prevent the closing sequence from being included.
Conclusion
CVE-2026-47080 is a critical vulnerability in the xml_builder package that can lead to serious security issues. It is essential to update to the patched version to mitigate risks. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for xml_builder →
FAQ
CVE-2026-47080 is a vulnerability in the xml_builder package that allows XML Injection through improper handling of CDATA sections.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground.
The vulnerability can lead to content spoofing and unauthorized XML markup injection, which may compromise the integrity of the generated XML documents.
Yes, the vulnerability is fixed in xml_builder version 2.4.1 and later. It is recommended to update to this version.
If an immediate update is not possible, consider sanitizing user input or avoiding the use of CDATA sections with untrusted data as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for xml_builder.
