Executive brief
xml_builder is an Elixir library for generating XML documents. The library fails to escape or validate element names, attribute names, and doctype identifiers, allowing an attacker who controls these names (e.g., from JSON keys or form fields) to inject malicious XML markup, comments, and attributes into the output. This can lead to content spoofing, data manipulation, or injection of executable attributes in XML documents processed downstream.
Technical details
This is an XML injection vulnerability in the xml_builder library (versions before 2.4.1). The vulnerable functions XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.element/1, XmlBuilder.element/2, and XmlBuilder.element/3 fail to escape or validate structural XML characters (<, >, ", ', &) when interpolating element names, attribute names, and doctype identifiers into serialized XML output. An attacker who can influence these name arguments—for example, through JSON object keys or HTTP form field names—can inject arbitrary XML markup including extra elements, comments, and event-handler attributes. The vulnerability affects xml_builder from version 0.0.1 through 2.4.0. No evidence of active exploitation in the wild has been reported.
Affected products
- joshnuss xml_builder 0.0.1 before 2.4.1
Timeline
- 2026-08-21: disclosed