AIKIDO-2026-59808
xml_builder is vulnerable to XML Injection
21
Low Risk
This Affects:
xml_builderTL;DR
The library inserts element names, attribute names, and doctype identifiers directly into the serialized output without validation or escaping. When those name values are externally influenced, characters such as < and > let the input close the current tag and add comments, elements, or attributes to the generated document. This lets untrusted names corrupt the XML structure and inject markup that is interpreted when the output is later rendered as HTML or SVG. The fix validates and escapes names before they are written to the document.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you pass externally influenced values as element names, attribute names, or doctype identifiers.
Background info
xml_builder is vulnerable to XML Injection in versions 0.0.1 - 2.4.0.
How to fix this
Upgrade the xml_builder library to the patch version.
Links
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant