# CVE-2026-47079: joshnuss xml_builder inappropriate entity encoding in XmlBuilder.generate

Source: https://junglewise.ai/threats/cve-2026-47079-joshnuss-xml-builder-inappropriate-entity-encoding-in-xmlbuilder  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-47079 · Severity: info · CVSS 5.3 · Published 2026-08-21

xml_builder is a popular Elixir library used to generate XML documents. The library fails to properly escape ampersands in text and attribute values, allowing attackers to inject markup (such as <script>) that bypasses input filters. When the generated XML is parsed and rendered in a web or markup-sensitive context, this injected markup can execute, leading to cross-site scripting or content spoofing attacks.

Technologies: [Joshnuss Xml Builder](https://junglewise.ai/threats/technologies/xml-builder). Vendors: [Joshnuss](https://junglewise.ai/threats/vendors/joshnuss).

## Quick answers

**Is CVE-2026-47079 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47079 being exploited in the wild.

**How severe is CVE-2026-47079?** Informational severity, with a CVSS score of 5.3, published 21 August 2026.

**Which products and versions are affected?** Joshnuss Xml Builder 0.0.6 to before 2.4.1.

**Is there a fix for CVE-2026-47079?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-47079 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-47079?** Check whether you run Joshnuss Xml Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper output encoding (CWE-116) in the XmlBuilder.generate/1 and XmlBuilder.generate/2 functions. The root cause is that XmlBuilder.escape_string/1 and XmlBuilder.escape_entity/1 do not escape literal ampersand characters when they are followed by entity-like tokens (lt;, gt;, amp;, quot;, apos;). This allows attacker-controlled input containing sequences such as <script> to pass through unescaped into the serialized XML output. When a downstream XML parser reads the document, it decodes these entity sequences into literal markup characters (< → <), which can then be interpreted as real XML/HTML markup if the text is rendered in a markup context. Both element text and attribute values are vulnerable. The attack requires no authentication and affects xml_builder versions 0.0.6 through 2.4.0.

## Affected products

- joshnuss xml_builder 0.0.6 to before 2.4.1

## Timeline

- 2026-08-21: disclosed
- 2026-08-21: advisory

## References

- [https://repo.hex.pm/](https://repo.hex.pm/)
- [https://github.com/](https://github.com/)

## Related threats

- [joshnuss xml_builder XML injection in element and attribute names](https://junglewise.ai/threats/cve-2026-48590-joshnuss-xml-builder-xml-injection-in-element-and-attribute-names)
- [joshnuss xml_builder XML injection via CDATA escape](https://junglewise.ai/threats/cve-2026-47080-joshnuss-xml-builder-xml-injection-via-cdata-escape)