Executive brief
xml_builder is a popular Elixir library used to generate XML documents. The library fails to properly escape ampersands in text and attribute values, allowing attackers to inject markup (such as <script>) that bypasses input filters. When the generated XML is parsed and rendered in a web or markup-sensitive context, this injected markup can execute, leading to cross-site scripting or content spoofing attacks.
Technical details
The vulnerability is an improper output encoding (CWE-116) in the XmlBuilder.generate/1 and XmlBuilder.generate/2 functions. The root cause is that XmlBuilder.escape_string/1 and XmlBuilder.escape_entity/1 do not escape literal ampersand characters when they are followed by entity-like tokens (lt;, gt;, amp;, quot;, apos;). This allows attacker-controlled input containing sequences such as <script> to pass through unescaped into the serialized XML output. When a downstream XML parser reads the document, it decodes these entity sequences into literal markup characters (< → <), which can then be interpreted as real XML/HTML markup if the text is rendered in a markup context. Both element text and attribute values are vulnerable. The attack requires no authentication and affects xml_builder versions 0.0.6 through 2.4.0.
Affected products
- joshnuss xml_builder 0.0.6 to before 2.4.1
Timeline
- 2026-08-21: disclosed
- 2026-08-21: advisory