CVE-2026-66293

XML comment injection in Saxy encoder via unescaped double hyphen

Products / packages qcam saxy · saxy

Published 06/11/2026, 10:16:42 UTC

Severity and exploitation

Not in CISA KEV

KEV coverage does not rule out exploitation.

KEV checked 15/11/2026, 00:15:33 UTC

OSV · CVSS:4.0 · 2.1

Assessment vector

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

EEF · CVSS:4.0 · 2.1

Assessment vector

CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

The headline uses the highest imported catalog score. Assessments can differ by source and CVSS version.

Severity

low2.1

CVSS measures technical severity, not the likelihood of an attack.

Known exploitation

Not listed in the checked CISA KEV catalog

Absence from CISA KEV does not rule out attacks.

Public exploit

Not established by this record

Missing evidence does not mean no public exploit exists.

Remediation

Package fixes recorded

Fix versions are recorded for 1 of 1 mapped packages. Check each release branch and any separate product guidance.

What this means

Saxy encoder versions 0.7.0 before 1.7.0 are affected by XML comment injection via unescaped double hyphen, allowing attackers to inject arbitrary markup when untrusted text is serialized as a comment. The attacker must have access to the text being serialized. This may lead to stored cross-site scripting or forged data.

Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.

Attack conditions

No attack-condition excerpt has been identified here. Review the full source description and references for authentication, network access, and configuration requirements.

Review supporting sources →

Affected versions

Check the exact model, release, and any platform requirements against your installation.

qcam · EEF

saxy

1 range

EEF version evidence

Package identity

pkg:hex/saxyExplore saxy →

Identity supplied by EEF. Version matching requires compatible range evidence.

Check a product version

Compare with this publisher’s ranges. This does not inspect your installation.

affected

0.7.0 → before 1.7.0

semver versions

Other versions: unaffected

Product identifiers (CPE)

cpe:2.3:a:qcam:saxy:*:*:*:*:*:*:*:*

qcam · EEF

saxy

1 range

EEF version evidence

Package identity

pkg:github/qcam/saxy

Identity supplied by EEF. Version matching requires compatible range evidence.

Check a product version

Compare with this publisher’s ranges. This does not inspect your installation.

affected

7266632e9407842f28ffac254c56dc41210a5690 → before 6d12ee12b9e32e86ef598b3f3cafccd1840b2f41

git versions

Other versions: unaffected

Product identifiers (CPE)

cpe:2.3:a:qcam:saxy:*:*:*:*:*:*:*:*

Packages

Compare each installed version with the publisher’s affected ranges. Where a fix is recorded, choose the appropriate release branch and test compatibility before upgrading.

saxy Hex

Affected range	Recorded fix
From 0.7.0 before 1.7.0Semantic versions	1.7.0

Version evidence: OSV · EEF-CVE-2026-66293

View original version evidence (15 explicit versions)

Source version evidence

This source records affected versions without identifying a package ecosystem and name. This evidence is not used for package matching.

What to do

Compare your installed product and version with the affected versions above. A matching product name alone does not confirm exposure.

Use the recorded fix for your release branch. Review the publisher’s instructions and test compatibility before upgrading.

Reject or rewrite the -- sequence in untrusted text before passing it to Saxy.XML.comment/1, for example by replacing -- with - -.

Alternatively, stop emitting untrusted data as XML comments. Comments carry no semantic payload for consumers, so the text can usually be moved into an element or a CDATA section instead.

EEF guidance ↗

cve.new guidance unless attributed to a publisher. This page does not inspect your installation.

Public exploit evidence

No public exploit reference is identified in the imported evidence. This is not a claim that no exploit exists.

Original source description

Read the full publisher description

Summary

XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escape_comment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an interior -- nor a full --> is escaped or rejected before the encoder wraps the content in the  delimiters.

When an application serializes attacker-controlled text as a comment, through Saxy.XML.comment/1 or a raw {:comment, text} simple form child, the attacker can close the comment early with --> and inject arbitrary sibling markup into the serialized document. A downstream parser then sees elements, attributes, and text that the application never built. Where the document is rendered as HTML or SVG, the injected markup executes as stored cross-site scripting; where it is consumed by another XML processor, the attacker can forge data that the producing application never emitted. Documents that Saxy only parses are not a vector.

This issue affects saxy: from 0.7.0 before 1.7.0.

Workarounds

Reject or rewrite the -- sequence in untrusted text before passing it to Saxy.XML.comment/1, for example by replacing -- with - -.

Alternatively, stop emitting untrusted data as XML comments. Comments carry no semantic payload for consumers, so the text can usually be moved into an element or a CDATA section instead.

Configurations

Only applications that place untrusted text into an XML comment node are affected. The untrusted value must reach Saxy.XML.comment/1 or a raw {:comment, text} simple form child that is then serialized with Saxy.encode!/2 or Saxy.encode_to_iodata!/2. Documents that are only parsed by Saxy never reach the encoder and are not a vector.

References

6 sources

qcam/saxy · security/advisories/GHSA-mm3m-xwmf-v698

Vendor advisoryEEF

qcam/saxy · commit 6d12ee1

PatchEEF

cna.erlef.org/cves/CVE-2026-66293.html

Security advisoryEEF

qcam/saxy · commit 7266632

PatchEEF

hex.pm/packages/saxy

Source reference

osv.dev/vulnerability/EEF-CVE-2026-66293

Security advisoryEEF

Inside the record

Evidence available

Package identity

Version evidence

Remediation guidance

Weakness classification

Additional publishers

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-66293

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Underlying weaknesses

The source’s classification of what caused the vulnerability.

CWE-91 ↗

CWE-91 XML Injection

EEF

Environment requirements

These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.

EEF · platform conditions

All conditions must hold

Any condition may hold

Vulnerable product

cpe:2.3:a:qcam:saxy:*:*:*:*:*:*:*:*

From (inclusive): 0.7.0

After:

Through (inclusive):

Before: 1.7.0

Applicability preview

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:qcam:saxy:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "1.7.0",
            "versionStartIncluding": "0.7.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]

Contributing organizations · 2

EEF

Assigning organization

2026-11-06

CISA-ADP

Additional data publisher

2026-11-10

Timeline

All times UTC

6 Nov 2026, 10:16
Advisory published
Publication date supplied by the source.
10 Nov 2026, 17:42
Source updated
Latest modification date supplied by the source.
10 Nov 2026, 17:52
Last imported by cve.new
Latest catalog import, not the date we first saw this advisory.

What changed

Follow changes

CVE · CVE-2026-662932026-11-10

Observed 2026-11-10T17:52:57.540Z · upstream updated 2026-11-10T17:42:24.114Z

Prioritization updated

before

[]

after

[
  {
    "source": "CISA-ADP",
    "type": "SSVC",
    "role": "CISA Coordinator",
    "timestamp": "2026-11-10T17:42:07.677044Z",
    "decisions": [
      {
        "name": "Exploitation",
        "value": "none"
      },
      {
        "name": "Automatable",
        "value": "no"
      },
      {
        "name": "Technical Impact",
        "value": "partial"
      }
    ]
  }
]

Large field values are marked as truncated previews. Original source snapshots remain retained.

Showing up to 50 most recent observed changes.

Reading the signals

Severity · CVSS: Technical impact and attack conditions. The headline is the highest imported catalog score; sources may disagree.
Observed exploitation · KEV: An absent or unavailable KEV listing does not establish that exploitation has not occurred.
Predicted exploitation · EPSS: No EPSS estimate available in this record.

CISA-ADP · SSVC

CISA Coordinator · 2026-11-10

Exploitation: none
Automatable: no
Technical Impact: partial

SSVC describes the publisher’s decision context. Your organization’s exposure and priorities may differ.

Record identifiers

Aliases: EEF-CVE-2026-66293 GHSA-mm3m-xwmf-v698

Source evidence

Request a correction or dispute

Start with the assigning organization for this record. Include the CVE ID, the disputed information, and supporting evidence. A dispute does not itself reject a record.

Find the responsible CNA →Official dispute and escalation process ↗

OSV EEF-CVE-2026-66293 CVE CVE-2026-66293

Enrichment coverage

NVDNo result

Checked 06/11/2026, 10:55:33 UTC

GHSANo result

Checked 06/11/2026, 10:55:33 UTC

EUVDNo result

Checked 06/11/2026, 10:55:33 UTC

EPSSNo result

Checked 06/11/2026, 10:55:33 UTC

Sponsored by MoxsoBuild security habits with adaptive training and phishing simulations.View as JSON

Investigate in your agent.

XML comment injection in Saxy encoder via unescaped double hyphen

Severity and exploitation

What this means

Attack conditions

Affected versions

saxy

affected

unaffected

unknown

saxy

affected

unaffected

unknown

Packages

Source version evidence

What to do

Public exploit evidence

Original source description

Summary

Workarounds

Configurations

References

Inside the record

Evidence available

Original records

Underlying weaknesses

Environment requirements

Timeline

Advisory published

Source updated

Last imported by cve.new

What changed