CVE-2026-48590
Received Received - Intake

XML Injection in xml_builder Ruby Gem

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: EEF

Description
XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection. This vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.element/1, XmlBuilder.element/2, XmlBuilder.element/3. Element names, attribute names, and doctype identifiers are interpolated verbatim into the serialized XML output without validation or escaping of structural characters (<, >, ", ', &). An attacker who can influence a name argument (for example, an element name derived from a JSON object key or an HTTP form field name) can inject arbitrary XML markup including extra elements, comments, and event-handler attributes into the output document. This issue affects xml_builder: from 0.0.1 before 2.4.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-48590
EUVD
EUVD-2026-63879

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
joshnuss xml_builder From 0.0.1 (inc) to 2.4.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-91 The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an XML Injection vulnerability in the xml_builder library (versions 0.0.1 to 2.4.1) that allows attackers to inject arbitrary XML markup by manipulating element names, attribute names, or doctype identifiers. The library does not validate or escape structural characters like <, >, ", ', and &, enabling content spoofing and XML injection through functions like XmlBuilder.generate and XmlBuilder.element.

Detection Guidance

Check if your system uses xml_builder versions before 2.4.1 by inspecting dependency files like mix.exs or rebar.config. Look for XML output generation in code paths using XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.element/1, XmlBuilder.element/2, or XmlBuilder.element/3.

Impact Analysis

An attacker could inject malicious XML markup, such as extra elements, comments, or event-handler attributes, into the generated XML output. If this output is rendered in a browser, it may lead to script execution or other unintended behavior, potentially compromising the application or user data.

Compliance Impact

This vulnerability primarily affects XML output integrity by allowing injection of arbitrary markup through unvalidated element and attribute names. While it does not directly violate GDPR or HIPAA, it could indirectly impact compliance by enabling content spoofing or script injection if the XML is rendered in user interfaces, potentially leading to data integrity issues or unauthorized access in systems handling sensitive data.

Mitigation Strategies

Upgrade xml_builder to version 2.4.1 or later. Review XML generation code to ensure no user-controlled input reaches element names, attribute names, or doctype identifiers. Implement input validation to reject or sanitize characters like <, >, ", ', &, /, and = in names.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48590. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart