Is CVE-2026-48590 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48590 being exploited in the wild.

How severe is CVE-2026-48590?

Informational severity, published 21 August 2026.

Which products and versions are affected?

Joshnuss Xml Builder 0.0.1 before 2.4.1.

Is there a fix for CVE-2026-48590?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-48590 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-48590?

Check whether you run Joshnuss Xml Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48590: joshnuss xml_builder XML injection in element and attribute names

CVE-2026-48590 · Severity: info · Published 2026-08-21

xml_builder is an Elixir library for generating XML documents. The library fails to escape or validate element names, attribute names, and doctype identifiers, allowing an attacker who controls these names (e.g., from JSON keys or form fields) to inject malicious XML markup, comments, and attributes into the output. This can lead to content spoofing, data manipulation, or injection of executable attributes in XML documents processed downstream.

Technologies: Joshnuss Xml Builder. Vendors: Joshnuss.

Quick answers

Is CVE-2026-48590 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48590 being exploited in the wild.
How severe is CVE-2026-48590?: Informational severity, published 21 August 2026.
Which products and versions are affected?: Joshnuss Xml Builder 0.0.1 before 2.4.1.
Is there a fix for CVE-2026-48590?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-48590 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-48590?: Check whether you run Joshnuss Xml Builder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an XML injection vulnerability in the xml_builder library (versions before 2.4.1). The vulnerable functions XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.element/1, XmlBuilder.element/2, and XmlBuilder.element/3 fail to escape or validate structural XML characters (<, >, ", ', &) when interpolating element names, attribute names, and doctype identifiers into serialized XML output. An attacker who can influence these name arguments—for example, through JSON object keys or HTTP form field names—can inject arbitrary XML markup including extra elements, comments, and event-handler attributes. The vulnerability affects xml_builder from version 0.0.1 through 2.4.0. No evidence of active exploitation in the wild has been reported.

Affected products

joshnuss xml_builder 0.0.1 before 2.4.1

Timeline

2026-08-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.