CVE-2026-66293

Description

XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escape_comment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an interior -- nor a full --> is escaped or rejected before the encoder wraps the content in the <!-- and --> delimiters. When an application serializes attacker-controlled text as a comment, through Saxy.XML.comment/1 or a raw {:comment, text} simple form child, the attacker can close the comment early with --> and inject arbitrary sibling markup into the serialized document. A downstream parser then sees elements, attributes, and text that the application never built. Where the document is rendered as HTML or SVG, the injected markup executes as stored cross-site scripting; where it is consumed by another XML processor, the attacker can forge data that the producing application never emitted. Documents that Saxy only parses are not a vector. This issue affects saxy: from 0.7.0 before 1.7.0.

References

• https://cna.erlef.org/cves/CVE-2026-66293.html
• https://github.com/qcam/saxy/commit/6d12ee12b9e32e86ef598b3f3cafccd1840b2f41
• https://github.com/qcam/saxy/commit/7266632e9407842f28ffac254c56dc41210a5690
• https://github.com/qcam/saxy/security/advisories/GHSA-mm3m-xwmf-v698
• https://osv.dev/vulnerability/EEF-CVE-2026-66293