AIKIDO-2026-48285
xml_builder is vulnerable to XML Injection
21
Low Risk
This Affects:
xml_builderTL;DR
The library builds XML from Elixir terms and writes {:cdata, value} content directly between the <![CDATA[ and ]]> delimiters. When the value contains a ]]> sequence the CDATA section closes early and the trailing text is emitted as raw markup. Externally influenced content wrapped in a CDATA tuple can therefore break out of the section and inject arbitrary XML nodes that downstream parsers treat as real elements. The fix rewrites embedded ]]> sequences so CDATA content can no longer terminate the block.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you wrap externally influenced input in a {:cdata, ...} tuple whose output is consumed by a downstream XML parser.
Background info
xml_builder is vulnerable to XML Injection in versions 0.0.7 - 2.4.0.
How to fix this
Upgrade the xml_builder library to the patch version.
Links
Other
cna.erlef.org/cves/CVE-2026-47080.htmlosv.dev/vulnerability/EEF-CVE-2026-47080vincent.vulcoord.net/score/?state=Not+Scored&year=2026&year=2025&assigned_to=88bc49d9-8ddd-4227-affc-a613e67abc4d&ordering=-published&cve=CVE-2026-47080
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant