Vulnerability-Lookup

GHSA-7H52-PQGV-PCWC

Vulnerability from github – Published: 2026-11-06 12:30 – Updated: 2026-11-06 12:30

Details

When an application serializes attacker-controlled text as a comment, through Saxy.XML.comment/1 or a raw {:comment, text} simple form child, the attacker can close the comment early with --> and inject arbitrary sibling markup into the serialized document. A downstream parser then sees elements, attributes, and text that the application never built. Where the document is rendered as HTML or SVG, the injected markup executes as stored cross-site scripting; where it is consumed by another XML processor, the attacker can forge data that the producing application never emitted. Documents that Saxy only parses are not a vector.

This issue affects saxy: from 0.7.0 before 1.7.0.

Severity

2.1 (Low)


                  
                    CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-66293"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-91"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-11-06T11:17:16Z",
    "severity": "LOW"
  },
  "details": "XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escape_comment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an interior -- nor a full --\u003e is escaped or rejected before the encoder wraps the content in the \u003c!-- and --\u003e delimiters.\n\nWhen an application serializes attacker-controlled text as a comment, through Saxy.XML.comment/1 or a raw {:comment, text} simple form child, the attacker can close the comment early with --\u003e and inject arbitrary sibling markup into the serialized document. A downstream parser then sees elements, attributes, and text that the application never built. Where the document is rendered as HTML or SVG, the injected markup executes as stored cross-site scripting; where it is consumed by another XML processor, the attacker can forge data that the producing application never emitted. Documents that Saxy only parses are not a vector.\n\nThis issue affects saxy: from 0.7.0 before 1.7.0.",
  "id": "GHSA-7h52-pqgv-pcwc",
  "modified": "2026-11-06T12:30:45Z",
  "published": "2026-11-06T12:30:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/qcam/saxy/security/advisories/GHSA-mm3m-xwmf-v698"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66293"
    },
    {
      "type": "WEB",
      "url": "https://github.com/qcam/saxy/commit/6d12ee12b9e32e86ef598b3f3cafccd1840b2f41"
    },
    {
      "type": "WEB",
      "url": "https://github.com/qcam/saxy/commit/7266632e9407842f28ffac254c56dc41210a5690"
    },
    {
      "type": "WEB",
      "url": "https://cna.erlef.org/cves/CVE-2026-66293.html"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-66293"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2026-66293 (GCVE-0-2026-66293)

Vulnerability from cvelistv5 – Published: 2026-11-06 10:16 – Updated: 2026-11-06 10:16

Title

XML comment injection in Saxy encoder via unescaped double hyphen

Summary

XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escape_comment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an interior -- nor a full --> is escaped or rejected before the encoder wraps the content in the  delimiters. When an application serializes attacker-controlled text as a comment, through Saxy.XML.comment/1 or a raw {:comment, text} simple form child, the attacker can close the comment early with --> and inject arbitrary sibling markup into the serialized document. A downstream parser then sees elements, attributes, and text that the application never built. Where the document is rendered as HTML or SVG, the injected markup executes as stored cross-site scripting; where it is consumed by another XML processor, the attacker can forge data that the producing application never emitted. Documents that Saxy only parses are not a vector. This issue affects saxy: from 0.7.0 before 1.7.0.

Severity

2.1 (Low)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

CWE

CWE-91 - XML Injection

Assigner

EEF CNA under the mitre root

CNA scorecard A 97/100 over 351 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/qcam/saxy/security/advisories/…	vendor-advisoryrelated
https://cna.erlef.org/cves/CVE-2026-66293.html	related
https://osv.dev/vulnerability/EEF-CVE-2026-66293	related
https://github.com/qcam/saxy/commit/7266632e94078…	related
https://github.com/qcam/saxy/commit/6d12ee12b9e32…	patch

Impacted products

2 products

Vendor	Product	Version
qcam	saxy	Affected: 0.7.0 , < 1.7.0 (semver) cpe:2.3:a:qcam:saxy::::::::
qcam	saxy	Affected: 7266632e9407842f28ffac254c56dc41210a5690 , < 6d12ee12b9e32e86ef598b3f3cafccd1840b2f41 (git) cpe:2.3:a:qcam:saxy::::::::

Credits

Peter Ullrich Peter Ullrich Peter Ullrich Cẩm Huỳnh Jonatan Männchen / EEF Peter Ullrich

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:qcam:saxy:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Saxy\u0027",
            "\u0027Elixir.Saxy.Encoder\u0027",
            "\u0027Elixir.Saxy.XML\u0027"
          ],
          "packageName": "saxy",
          "packageURL": "pkg:hex/saxy",
          "product": "saxy",
          "programFiles": [
            "lib/saxy.ex",
            "lib/saxy/encoder.ex",
            "lib/saxy/xml.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Saxy\u0027:encode!/2"
            },
            {
              "name": "\u0027Elixir.Saxy\u0027:encode_to_iodata!/2"
            },
            {
              "name": "\u0027Elixir.Saxy.XML\u0027:comment/1"
            }
          ],
          "repo": "https://github.com/qcam/saxy",
          "vendor": "qcam",
          "versions": [
            {
              "lessThan": "1.7.0",
              "status": "affected",
              "version": "0.7.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:qcam:saxy:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Saxy\u0027",
            "\u0027Elixir.Saxy.Encoder\u0027",
            "\u0027Elixir.Saxy.XML\u0027"
          ],
          "packageName": "qcam/saxy",
          "packageURL": "pkg:github/qcam/saxy",
          "product": "saxy",
          "programFiles": [
            "lib/saxy.ex",
            "lib/saxy/encoder.ex",
            "lib/saxy/xml.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Saxy\u0027:encode!/2"
            },
            {
              "name": "\u0027Elixir.Saxy\u0027:encode_to_iodata!/2"
            },
            {
              "name": "\u0027Elixir.Saxy.XML\u0027:comment/1"
            }
          ],
          "repo": "https://github.com/qcam/saxy",
          "vendor": "qcam",
          "versions": [
            {
              "lessThan": "6d12ee12b9e32e86ef598b3f3cafccd1840b2f41",
              "status": "affected",
              "version": "7266632e9407842f28ffac254c56dc41210a5690",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOnly applications that place untrusted text into an XML comment node are affected. The untrusted value must reach \u003ccode\u003eSaxy.XML.comment/1\u003c/code\u003e or a raw \u003ccode\u003e{:comment, text}\u003c/code\u003e simple form child that is then serialized with \u003ccode\u003eSaxy.encode!/2\u003c/code\u003e or \u003ccode\u003eSaxy.encode_to_iodata!/2\u003c/code\u003e. Documents that are only parsed by Saxy never reach the encoder and are not a vector.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Only applications that place untrusted text into an XML comment node are affected. The untrusted value must reach `Saxy.XML.comment/1` or a raw `{:comment, text}` simple form child that is then serialized with `Saxy.encode!/2` or `Saxy.encode_to_iodata!/2`. Documents that are only parsed by Saxy never reach the encoder and are not a vector."
            }
          ],
          "value": "Only applications that place untrusted text into an XML comment node are affected. The untrusted value must reach Saxy.XML.comment/1 or a raw {:comment, text} simple form child that is then serialized with Saxy.encode!/2 or Saxy.encode_to_iodata!/2. Documents that are only parsed by Saxy never reach the encoder and are not a vector."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:qcam:saxy:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.7.0",
                  "versionStartIncluding": "0.7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "C\u1ea9m Hu\u1ef3nh"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Peter Ullrich"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eXML injection in the encoder of Saxy. \u003ccode\u003eSaxy.Encoder\u003c/code\u003e does not neutralize the \u003ccode\u003e--\u003c/code\u003e sequence in XML comment content: \u003ccode\u003eescape_comment/2\u003c/code\u003e returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single \u003ccode\u003e-\u003c/code\u003e, so neither an interior \u003ccode\u003e--\u003c/code\u003e nor a full \u003ccode\u003e--\u0026gt;\u003c/code\u003e is escaped or rejected before the encoder wraps the content in the \u003ccode\u003e\u0026lt;!--\u003c/code\u003e and \u003ccode\u003e--\u0026gt;\u003c/code\u003e delimiters.\u003c/p\u003e\n\u003cp\u003eWhen an application serializes attacker-controlled text as a comment, through \u003ccode\u003eSaxy.XML.comment/1\u003c/code\u003e or a raw \u003ccode\u003e{:comment, text}\u003c/code\u003e simple form child, the attacker can close the comment early with \u003ccode\u003e--\u0026gt;\u003c/code\u003e and inject arbitrary sibling markup into the serialized document. A downstream parser then sees elements, attributes, and text that the application never built. Where the document is rendered as HTML or SVG, the injected markup executes as stored cross-site scripting; where it is consumed by another XML processor, the attacker can forge data that the producing application never emitted. Documents that Saxy only parses are not a vector.\u003c/p\u003e\n\u003cp\u003eThis issue affects saxy: from 0.7.0 before 1.7.0.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "XML injection in the encoder of Saxy. `Saxy.Encoder` does not neutralize the `--` sequence in XML comment content: `escape_comment/2` returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single `-`, so neither an interior `--` nor a full `--\u003e` is escaped or rejected before the encoder wraps the content in the `\u003c!--` and `--\u003e` delimiters.\n\nWhen an application serializes attacker-controlled text as a comment, through `Saxy.XML.comment/1` or a raw `{:comment, text}` simple form child, the attacker can close the comment early with `--\u003e` and inject arbitrary sibling markup into the serialized document. A downstream parser then sees elements, attributes, and text that the application never built. Where the document is rendered as HTML or SVG, the injected markup executes as stored cross-site scripting; where it is consumed by another XML processor, the attacker can forge data that the producing application never emitted. Documents that Saxy only parses are not a vector.\n\nThis issue affects saxy: from 0.7.0 before 1.7.0."
            }
          ],
          "value": "XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escape_comment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an interior -- nor a full --\u003e is escaped or rejected before the encoder wraps the content in the \u003c!-- and --\u003e delimiters.\n\nWhen an application serializes attacker-controlled text as a comment, through Saxy.XML.comment/1 or a raw {:comment, text} simple form child, the attacker can close the comment early with --\u003e and inject arbitrary sibling markup into the serialized document. A downstream parser then sees elements, attributes, and text that the application never built. Where the document is rendered as HTML or SVG, the injected markup executes as stored cross-site scripting; where it is consumed by another XML processor, the attacker can forge data that the producing application never emitted. Documents that Saxy only parses are not a vector.\n\nThis issue affects saxy: from 0.7.0 before 1.7.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-250",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-250 XML Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-91",
              "description": "CWE-91 XML Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T10:16:42.053Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/qcam/saxy/security/advisories/GHSA-mm3m-xwmf-v698"
        },
        {
          "name": "EEF CNA record for CVE-2026-66293",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-66293.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-66293",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-66293"
        },
        {
          "name": "Introducing commit 7266632 in qcam/saxy",
          "tags": [
            "related"
          ],
          "url": "https://github.com/qcam/saxy/commit/7266632e9407842f28ffac254c56dc41210a5690"
        },
        {
          "name": "Fix commit 6d12ee1 in qcam/saxy",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/qcam/saxy/commit/6d12ee12b9e32e86ef598b3f3cafccd1840b2f41"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "XML comment injection in Saxy encoder via unescaped double hyphen",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eReject or rewrite the \u003ccode\u003e--\u003c/code\u003e sequence in untrusted text before passing it to \u003ccode\u003eSaxy.XML.comment/1\u003c/code\u003e, for example by replacing \u003ccode\u003e--\u003c/code\u003e with \u003ccode\u003e- -\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eAlternatively, stop emitting untrusted data as XML comments. Comments carry no semantic payload for consumers, so the text can usually be moved into an element or a CDATA section instead.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Reject or rewrite the `--` sequence in untrusted text before passing it to `Saxy.XML.comment/1`, for example by replacing `--` with `- -`.\n\nAlternatively, stop emitting untrusted data as XML comments. Comments carry no semantic payload for consumers, so the text can usually be moved into an element or a CDATA section instead."
            }
          ],
          "value": "Reject or rewrite the -- sequence in untrusted text before passing it to Saxy.XML.comment/1, for example by replacing -- with - -.\n\nAlternatively, stop emitting untrusted data as XML comments. Comments carry no semantic payload for consumers, so the text can usually be moved into an element or a CDATA section instead."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-66293",
    "datePublished": "2026-11-06T10:16:42.053Z",
    "dateReserved": "2026-07-24T14:10:01.114Z",
    "dateUpdated": "2026-11-06T10:16:42.053Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted