{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "source": "REFERENCES"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "bfb1ada071ccc1e384c30f782197ca5154106706"
            }
          ],
          "repo": "https://github.com/joshnuss/xml_builder",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-67r9-hmxw-h595"
  ],
  "database_specific": {
    "cna_assigner": "EEF",
    "cwe_ids": [
      "CWE-91"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47080.json",
    "unresolved_ranges": [
      {
        "extracted_events": [
          {
            "introduced": "0.0.7"
          },
          {
            "fixed": "2.4.1"
          },
          {
            "introduced": "26766f884ed19adee1563522c7afb5f056a6f3b5"
          },
          {
            "fixed": "bfb1ada071ccc1e384c30f782197ca5154106706"
          }
        ],
        "source": "AFFECTED_FIELD"
      },
      {
        "extracted_events": [
          {
            "introduced": "0.0.7"
          },
          {
            "fixed": "2.4.1"
          }
        ],
        "source": "CPE_FIELD"
      },
      {
        "extracted_events": [
          {
            "introduced": "0.0.7"
          },
          {
            "fixed": "2.4.1"
          }
        ],
        "source": "DESCRIPTION"
      }
    ]
  },
  "details": "XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection.\n\nThis vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape/1.\n\nThe escape/1 clause for {:cdata, data} in lib/xml_builder.ex concatenates data verbatim between the CDATA opener \u003c![CDATA[ and closer ]]\u003e without rewriting or splitting on the embedded ]]\u003e sequence. Because CDATA sections have no internal escape mechanism, the only safe way to embed arbitrary bytes is to split on ]]\u003e and emit adjacent CDATA sections. An attacker who can supply input containing ]]\u003e closes the CDATA section early; any bytes that follow are parsed as ordinary XML markup by downstream consumers, allowing injection of arbitrary elements, text, or entity references into the output document.\n\nThis issue affects xml_builder: from 0.0.7 before 2.4.1.",
  "id": "CVE-2026-47080",
  "modified": "2026-08-27T11:31:12.314258069Z",
  "published": "2026-08-21T09:49:34.772Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-47080.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-47080"
    },
    {
      "type": "WEB",
      "url": "https://repo.hex.pm"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47080.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/joshnuss/xml_builder/security/advisories/GHSA-67r9-hmxw-h595"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47080"
    },
    {
      "type": "FIX",
      "url": "https://github.com/joshnuss/xml_builder/commit/bfb1ada071ccc1e384c30f782197ca5154106706"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/joshnuss/xml_builder"
    },
    {
      "type": "EVIDENCE",
      "url": "https://vincent.vulcoord.net/score/?state=Not+Scored\u0026year=2026\u0026year=2025\u0026assigned_to=88bc49d9-8ddd-4227-affc-a613e67abc4d\u0026ordering=-published\u0026cve=CVE-2026-47080"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "CDATA Section Breakout via Unsanitised ]]\u003e in xml_builder"
}