https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 07:13:27 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-357272 EUVD-2026-357272 https://cve.radiocsirt.org/vuln/euvd-2026-357272 https://cve.radiocsirt.org/vuln/fkie_cve-2026-47079 <p>Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, Cross-site Scripting.</p> <p>This vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape_string/1, XmlBuilder.escape_entity/1.</p> <p>XmlBuilder.generate/1 does not escape literal &amp; characters in text or attribute values when they are followed by an entity-like token (lt;, gt;, amp;, quot;, apos;). As a result, attacker-supplied input such as &amp;lt;script&amp;gt; is emitted verbatim into the serialized XML rather than being escaped to &amp;amp;lt;script&amp;amp;gt;. When a downstream XML parser later reads the document, it decodes the entity sequences into the literal characters &lt;script&gt;, promoting inert-looking text into real markup. This allows an attacker to bypass upstream filters that block raw &lt; and &gt; characters, injecting markup into any downstream consumer that parses the produced XML and renders the text content in a markup-sensitive context (HTML, SVG, RSS/Atom feeds). Both element text and attribute values are affected.</p> <p>This issue affects xml_builder: from 0.0.6 before 2.4.1.</p> <p>Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, Cross-site Scripting.</p> <p>This vulnerability is associated with program files lib/xml_builder.ex and program routines XmlBuilder.generate/1, XmlBuilder.generate/2, XmlBuilder.escape_string/1, XmlBuilder.escape_entity/1.</p> <p>XmlBuilder.generate/1 does not escape literal &amp; characters in text or attribute values when they are followed by an entity-like token (lt;, gt;, amp;, quot;, apos;). As a result, attacker-supplied input such as &amp;lt;script&amp;gt; is emitted verbatim into the serialized XML rather than being escaped to &amp;amp;lt;script&amp;amp;gt;. When a downstream XML parser later reads the document, it decodes the entity sequences into the literal characters &lt;script&gt;, promoting inert-looking text into real markup. This allows an attacker to bypass upstream filters that block raw &lt; and &gt; characters, injecting markup into any downstream consumer that parses the produced XML and renders the text content in a markup-sensitive context (HTML, SVG, RSS/Atom feeds). Both element text and attribute values are affected.</p> <p>This issue affects xml_builder: from 0.0.6 before 2.4.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-47079