{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "source": "REFERENCES"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "d5c0aec32a8eecbb440fb9bbb0f59d4d188d5859"
            }
          ],
          "repo": "https://github.com/joshnuss/xml_builder",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-r82p-3q2p-728w"
  ],
  "database_specific": {
    "cna_assigner": "EEF",
    "cwe_ids": [
      "CWE-91"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48590.json",
    "unresolved_ranges": [
      {
        "extracted_events": [
          {
            "introduced": "0.0.1"
          },
          {
            "fixed": "2.4.1"
          },
          {
            "introduced": "9fb49131ad3ee146a4c9db9bc175bdffe32e30a0"
          },
          {
            "fixed": "d5c0aec32a8eecbb440fb9bbb0f59d4d188d5859"
          }
        ],
        "source": "AFFECTED_FIELD"
      },
      {
        "extracted_events": [
          {
            "introduced": "0.0.1"
          },
          {
            "fixed": "2.4.1"
          }
        ],
        "source": "CPE_FIELD"
      },
      {
        "extracted_events": [
          {
            "introduced": "0.0.1"
          },
          {
            "fixed": "2.4.1"
          }
        ],
        "source": "DESCRIPTION"
      }
    ]
  },
  "details": "XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection.\n\nThis vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.element/1, XmlBuilder.element/2, XmlBuilder.element/3.\n\nElement names, attribute names, and doctype identifiers are interpolated verbatim into the serialized XML output without validation or escaping of structural characters (\u003c, \u003e, \", ', \u0026). An attacker who can influence a name argument (for example, an element name derived from a JSON object key or an HTTP form field name) can inject arbitrary XML markup including extra elements, comments, and event-handler attributes into the output document.\n\nThis issue affects xml_builder: from 0.0.1 before 2.4.1.",
  "id": "CVE-2026-48590",
  "modified": "2026-08-27T11:31:02.701731979Z",
  "published": "2026-08-21T09:51:25.412Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-48590.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-48590"
    },
    {
      "type": "WEB",
      "url": "https://repo.hex.pm"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48590.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/joshnuss/xml_builder/security/advisories/GHSA-r82p-3q2p-728w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48590"
    },
    {
      "type": "FIX",
      "url": "https://github.com/joshnuss/xml_builder/commit/d5c0aec32a8eecbb440fb9bbb0f59d4d188d5859"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/joshnuss/xml_builder"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Element and Attribute Names Injected Verbatim into XML Output in xml_builder"
}