CVE-2026-66293

Dashboard / Vulnerabilities / CVE-2026-66293

CVE-2026-66293

Summary: XML comment injection in Saxy encoder via unescaped double hyphen

Details: XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escape_comment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an interior -- nor a full --> is escaped or rejected before the encoder wraps the content in the <!-- and --> delimiters. When an application serializes attacker-controlled text as a comment, through Saxy.XML.comment/1 or a raw {:comment, text} simple form child, the attacker can close the comment early with --> and inject arbitrary sibling markup into the serialized document. A downstream parser then sees elements, attributes, and text that the application never built. Where the document is rendered as HTML or SVG, the injected markup executes as stored cross-site scripting; where it is consumed by another XML processor, the attacker can forge data that the producing application never emitted. Documents that Saxy only parses are not a vector. This issue affects saxy: from 0.7.0 before 1.7.0.

References: https://cna.erlef.org/cves/CVE-2026-66293.html, https://github.com, https://osv.dev/vulnerability/EEF-CVE-2026-66293, https://repo.hex.pm, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66293.json, https://github.com/qcam/saxy/security/advisories/GHSA-mm3m-xwmf-v698, https://nvd.nist.gov/vuln/detail/CVE-2026-66293, https://github.com/qcam/saxy/commit/6d12ee12b9e32e86ef598b3f3cafccd1840b2f41, https://github.com/qcam/saxy/commit/7266632e9407842f28ffac254c56dc41210a5690, https://github.com/qcam/saxy