CVE-2026-48590 (GCVE-0-2026-48590)
Vulnerability from cvelistv5
Published
2026-08-21 09:51
Modified
2026-08-21 12:25
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-91 - XML Injection (aka Blind XPath Injection)
Summary
XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection.
This vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.element/1, XmlBuilder.element/2, XmlBuilder.element/3.
Element names, attribute names, and doctype identifiers are interpolated verbatim into the serialized XML output without validation or escaping of structural characters (<, >, ", ', &). An attacker who can influence a name argument (for example, an element name derived from a JSON object key or an HTTP form field name) can inject arbitrary XML markup including extra elements, comments, and event-handler attributes into the output document.
This issue affects xml_builder: from 0.0.1 before 2.4.1.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| joshnuss | xml_builder |
Version: 0.0.1 ≤ cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:* |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-48590",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T12:24:58.189871Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T12:25:33.127Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/joshnuss/xml_builder/security/advisories/GHSA-r82p-3q2p-728w"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.XmlBuilder\u0027"
],
"packageName": "xml_builder",
"packageURL": "pkg:hex/xml_builder",
"product": "xml_builder",
"programFiles": [
"lib/xml_builder.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/1"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/2"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:element/1"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:element/2"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:element/3"
}
],
"repo": "https://github.com/joshnuss/xml_builder",
"vendor": "joshnuss",
"versions": [
{
"lessThan": "2.4.1",
"status": "affected",
"version": "0.0.1",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.XmlBuilder\u0027"
],
"packageName": "joshnuss/xml_builder",
"packageURL": "pkg:github/joshnuss/xml_builder",
"product": "xml_builder",
"programFiles": [
"lib/xml_builder.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/1"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:generate/2"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:element/1"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:element/2"
},
{
"name": "\u0027Elixir.XmlBuilder\u0027:element/3"
}
],
"repo": "https://github.com/joshnuss/xml_builder",
"vendor": "joshnuss",
"versions": [
{
"lessThan": "d5c0aec32a8eecbb440fb9bbb0f59d4d188d5859",
"status": "affected",
"version": "9fb49131ad3ee146a4c9db9bc175bdffe32e30a0",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.4.1",
"versionStartIncluding": "0.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Peter Ullrich"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Joshua Nussbaum"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eXML Injection vulnerability in joshnuss xml_builder (\u003ccode\u003eXmlBuilder\u003c/code\u003e module) allows Content Spoofing, XML Injection.\u003c/p\u003e\n\u003cp\u003eThis vulnerability is associated with program files \u003ccode\u003elib/xml_builder.ex\u003c/code\u003e and program routines \u003ccode\u003eXmlBuilder.generate/1\u003c/code\u003e, \u003ccode\u003eXmlBuilder.generate/2\u003c/code\u003e, \u003ccode\u003eXmlBuilder.element/1\u003c/code\u003e, \u003ccode\u003eXmlBuilder.element/2\u003c/code\u003e, \u003ccode\u003eXmlBuilder.element/3\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eElement names, attribute names, and doctype identifiers are interpolated verbatim into the serialized XML output without validation or escaping of structural characters (\u003ccode\u003e\u0026lt;\u003c/code\u003e, \u003ccode\u003e\u0026gt;\u003c/code\u003e, \u003ccode\u003e\"\u003c/code\u003e, \u003ccode\u003e\u0027\u003c/code\u003e, \u003ccode\u003e\u0026amp;\u003c/code\u003e). An attacker who can influence a name argument (for example, an element name derived from a JSON object key or an HTTP form field name) can inject arbitrary XML markup including extra elements, comments, and event-handler attributes into the output document.\u003c/p\u003e\n\u003cp\u003eThis issue affects xml_builder: from 0.0.1 before 2.4.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "XML Injection vulnerability in joshnuss xml_builder (`XmlBuilder` module) allows Content Spoofing, XML Injection.\n\nThis vulnerability is associated with program files `lib/xml_builder.ex` and program routines `XmlBuilder.generate/1`, `XmlBuilder.generate/2`, `XmlBuilder.element/1`, `XmlBuilder.element/2`, `XmlBuilder.element/3`.\n\nElement names, attribute names, and doctype identifiers are interpolated verbatim into the serialized XML output without validation or escaping of structural characters (`\u003c`, `\u003e`, `\"`, `\u0027`, `\u0026`). An attacker who can influence a name argument (for example, an element name derived from a JSON object key or an HTTP form field name) can inject arbitrary XML markup including extra elements, comments, and event-handler attributes into the output document.\n\nThis issue affects xml_builder: from 0.0.1 before 2.4.1."
}
],
"value": "XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection.\n\nThis vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.element/1, XmlBuilder.element/2, XmlBuilder.element/3.\n\nElement names, attribute names, and doctype identifiers are interpolated verbatim into the serialized XML output without validation or escaping of structural characters (\u003c, \u003e, \", \u0027, \u0026). An attacker who can influence a name argument (for example, an element name derived from a JSON object key or an HTTP form field name) can inject arbitrary XML markup including extra elements, comments, and event-handler attributes into the output document.\n\nThis issue affects xml_builder: from 0.0.1 before 2.4.1."
}
],
"impacts": [
{
"capecId": "CAPEC-250",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-250 XML Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-91",
"description": "CWE-91 XML Injection (aka Blind XPath Injection)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T09:51:25.412Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/joshnuss/xml_builder/security/advisories/GHSA-r82p-3q2p-728w"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-48590.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-48590"
},
{
"tags": [
"patch"
],
"url": "https://github.com/joshnuss/xml_builder/commit/d5c0aec32a8eecbb440fb9bbb0f59d4d188d5859"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Element and Attribute Names Injected Verbatim into XML Output in xml_builder"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-48590",
"datePublished": "2026-08-21T09:51:25.412Z",
"dateReserved": "2026-05-22T09:36:56.833Z",
"dateUpdated": "2026-08-21T12:25:33.127Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-48590\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-21T12:24:58.189871Z\"}}}], \"references\": [{\"url\": \"https://github.com/joshnuss/xml_builder/security/advisories/GHSA-r82p-3q2p-728w\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-21T12:25:23.775Z\"}}], \"cna\": {\"title\": \"Element and Attribute Names Injected Verbatim into XML Output in xml_builder\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Peter Ullrich\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Joshua Nussbaum\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Jonatan M\\u00e4nnchen / EEF\"}], \"impacts\": [{\"capecId\": \"CAPEC-250\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-250 XML Injection\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 2.1, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"LOCAL\", \"baseSeverity\": \"LOW\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"LOW\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/joshnuss/xml_builder\", \"vendor\": \"joshnuss\", \"modules\": [\"\u0027Elixir.XmlBuilder\u0027\"], \"product\": \"xml_builder\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.0.1\", \"lessThan\": \"2.4.1\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:hex/xml_builder\", \"packageName\": \"xml_builder\", \"programFiles\": [\"lib/xml_builder.ex\"], \"collectionURL\": \"https://repo.hex.pm\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.XmlBuilder\u0027:generate/1\"}, {\"name\": \"\u0027Elixir.XmlBuilder\u0027:generate/2\"}, {\"name\": \"\u0027Elixir.XmlBuilder\u0027:element/1\"}, {\"name\": \"\u0027Elixir.XmlBuilder\u0027:element/2\"}, {\"name\": \"\u0027Elixir.XmlBuilder\u0027:element/3\"}]}, {\"cpes\": [\"cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*\"], \"repo\": \"https://github.com/joshnuss/xml_builder\", \"vendor\": \"joshnuss\", \"modules\": [\"\u0027Elixir.XmlBuilder\u0027\"], \"product\": \"xml_builder\", \"versions\": [{\"status\": \"affected\", \"version\": \"9fb49131ad3ee146a4c9db9bc175bdffe32e30a0\", \"lessThan\": \"d5c0aec32a8eecbb440fb9bbb0f59d4d188d5859\", \"versionType\": \"git\"}], \"packageURL\": \"pkg:github/joshnuss/xml_builder\", \"packageName\": \"joshnuss/xml_builder\", \"programFiles\": [\"lib/xml_builder.ex\"], \"collectionURL\": \"https://github.com\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"\u0027Elixir.XmlBuilder\u0027:generate/1\"}, {\"name\": \"\u0027Elixir.XmlBuilder\u0027:generate/2\"}, {\"name\": \"\u0027Elixir.XmlBuilder\u0027:element/1\"}, {\"name\": \"\u0027Elixir.XmlBuilder\u0027:element/2\"}, {\"name\": \"\u0027Elixir.XmlBuilder\u0027:element/3\"}]}], \"references\": [{\"url\": \"https://github.com/joshnuss/xml_builder/security/advisories/GHSA-r82p-3q2p-728w\", \"tags\": [\"vendor-advisory\", \"related\"]}, {\"url\": \"https://cna.erlef.org/cves/CVE-2026-48590.html\", \"tags\": [\"related\"]}, {\"url\": \"https://osv.dev/vulnerability/EEF-CVE-2026-48590\", \"tags\": [\"related\"]}, {\"url\": \"https://github.com/joshnuss/xml_builder/commit/d5c0aec32a8eecbb440fb9bbb0f59d4d188d5859\", \"tags\": [\"patch\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection.\\n\\nThis vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.element/1, XmlBuilder.element/2, XmlBuilder.element/3.\\n\\nElement names, attribute names, and doctype identifiers are interpolated verbatim into the serialized XML output without validation or escaping of structural characters (\u003c, \u003e, \\\", \u0027, \u0026). An attacker who can influence a name argument (for example, an element name derived from a JSON object key or an HTTP form field name) can inject arbitrary XML markup including extra elements, comments, and event-handler attributes into the output document.\\n\\nThis issue affects xml_builder: from 0.0.1 before 2.4.1.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eXML Injection vulnerability in joshnuss xml_builder (\u003ccode\u003eXmlBuilder\u003c/code\u003e module) allows Content Spoofing, XML Injection.\u003c/p\u003e\\n\u003cp\u003eThis vulnerability is associated with program files \u003ccode\u003elib/xml_builder.ex\u003c/code\u003e and program routines \u003ccode\u003eXmlBuilder.generate/1\u003c/code\u003e, \u003ccode\u003eXmlBuilder.generate/2\u003c/code\u003e, \u003ccode\u003eXmlBuilder.element/1\u003c/code\u003e, \u003ccode\u003eXmlBuilder.element/2\u003c/code\u003e, \u003ccode\u003eXmlBuilder.element/3\u003c/code\u003e.\u003c/p\u003e\\n\u003cp\u003eElement names, attribute names, and doctype identifiers are interpolated verbatim into the serialized XML output without validation or escaping of structural characters (\u003ccode\u003e\u0026lt;\u003c/code\u003e, \u003ccode\u003e\u0026gt;\u003c/code\u003e, \u003ccode\u003e\\\"\u003c/code\u003e, \u003ccode\u003e\u0027\u003c/code\u003e, \u003ccode\u003e\u0026amp;\u003c/code\u003e). An attacker who can influence a name argument (for example, an element name derived from a JSON object key or an HTTP form field name) can inject arbitrary XML markup including extra elements, comments, and event-handler attributes into the output document.\u003c/p\u003e\\n\u003cp\u003eThis issue affects xml_builder: from 0.0.1 before 2.4.1.\u003c/p\u003e\", \"base64\": false}, {\"type\": \"text/markdown\", \"value\": \"XML Injection vulnerability in joshnuss xml_builder (`XmlBuilder` module) allows Content Spoofing, XML Injection.\\n\\nThis vulnerability is associated with program files `lib/xml_builder.ex` and program routines `XmlBuilder.generate/1`, `XmlBuilder.generate/2`, `XmlBuilder.element/1`, `XmlBuilder.element/2`, `XmlBuilder.element/3`.\\n\\nElement names, attribute names, and doctype identifiers are interpolated verbatim into the serialized XML output without validation or escaping of structural characters (`\u003c`, `\u003e`, `\\\"`, `\u0027`, `\u0026`). An attacker who can influence a name argument (for example, an element name derived from a JSON object key or an HTTP form field name) can inject arbitrary XML markup including extra elements, comments, and event-handler attributes into the output document.\\n\\nThis issue affects xml_builder: from 0.0.1 before 2.4.1.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-91\", \"description\": \"CWE-91 XML Injection (aka Blind XPath Injection)\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:joshnuss:xml_builder:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"2.4.1\", \"versionStartIncluding\": \"0.0.1\"}], \"operator\": \"OR\"}], \"operator\": \"AND\"}], \"providerMetadata\": {\"orgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"shortName\": \"EEF\", \"dateUpdated\": \"2026-08-21T09:51:25.412Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-48590\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-21T12:25:33.127Z\", \"dateReserved\": \"2026-05-22T09:36:56.833Z\", \"assignerOrgId\": \"6b3ad84c-e1a6-4bf7-a703-f496b71e49db\", \"datePublished\": \"2026-08-21T09:51:25.412Z\", \"assignerShortName\": \"EEF\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…