{"id":"CVE-2026-66293","aliases":["EEF-CVE-2026-66293","GHSA-mm3m-xwmf-v698"],"title":"XML comment injection in Saxy encoder via unescaped double hyphen","titleSource":"OSV","descriptionSource":"OSV","description":"## Summary\n\nXML injection in the encoder of Saxy. `Saxy.Encoder` does not neutralize the `--` sequence in XML comment content: `escape_comment/2` returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single `-`, so neither an interior `--` nor a full `-->` is escaped or rejected before the encoder wraps the content in the `<!--` and `-->` delimiters.\n\nWhen an application serializes attacker-controlled text as a comment, through `Saxy.XML.comment/1` or a raw `{:comment, text}` simple form child, the attacker can close the comment early with `-->` and inject arbitrary sibling markup into the serialized document. A downstream parser then sees elements, attributes, and text that the application never built. Where the document is rendered as HTML or SVG, the injected markup executes as stored cross-site scripting; where it is consumed by another XML processor, the attacker can forge data that the producing application never emitted. Documents that Saxy only parses are not a vector.\n\nThis issue affects saxy: from 0.7.0 before 1.7.0.\n\n## Workarounds\n\nReject or rewrite the `--` sequence in untrusted text before passing it to `Saxy.XML.comment/1`, for example by replacing `--` with `- -`.\n\nAlternatively, stop emitting untrusted data as XML comments. Comments carry no semantic payload for consumers, so the text can usually be moved into an element or a CDATA section instead.\n\n## Configurations\n\nOnly applications that place untrusted text into an XML comment node are affected. The untrusted value must reach `Saxy.XML.comment/1` or a raw `{:comment, text}` simple form child that is then serialized with `Saxy.encode!/2` or `Saxy.encode_to_iodata!/2`. Documents that are only parsed by Saxy never reach the encoder and are not a vector.","severity":"low","score":2.1,"published":"2026-11-06T10:16:42.053Z","modified":"2026-11-10T17:42:24.114Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Hex","name":"saxy","sources":[{"name":"OSV · EEF-CVE-2026-66293","url":"https://osv.dev/vulnerability/EEF-CVE-2026-66293"}],"ranges":[{"events":[{"introduced":"0.7.0"},{"fixed":"1.7.0"}],"type":"SEMVER"}],"versions":["0.10.0","0.7.0","0.8.0","0.9.0","0.9.1","1.0.0","1.1.0","1.2.0","1.2.1","1.2.2","1.3.0","1.4.0","1.5.0","1.6.0","1.6.1"],"fixed":["1.7.0"]}],"sourceAffected":[{"ranges":[{"events":[{"introduced":"7266632e9407842f28ffac254c56dc41210a5690"},{"fixed":"6d12ee12b9e32e86ef598b3f3cafccd1840b2f41"}],"type":"GIT","repo":"https://github.com/qcam/saxy"}],"versions":["v1.6.1","v1.6.0","v1.5.0","v1.4.0","v1.3.0","v1.2.2","v1.2.1","v1.2.0","v1.1.0","v1.0.0","v0.10.0","v0.9.1","v0.8.0","v0.7.0"]}],"references":["https://github.com/qcam/saxy/security/advisories/GHSA-mm3m-xwmf-v698","https://cna.erlef.org/cves/CVE-2026-66293.html","https://github.com/qcam/saxy/commit/7266632e9407842f28ffac254c56dc41210a5690","https://github.com/qcam/saxy/commit/6d12ee12b9e32e86ef598b3f3cafccd1840b2f41","https://hex.pm/packages/saxy","https://osv.dev/vulnerability/EEF-CVE-2026-66293"],"sources":[{"name":"OSV","id":"EEF-CVE-2026-66293","modified":"2026-11-06T10:41:07.048263633Z","url":"https://osv.dev/vulnerability/EEF-CVE-2026-66293"},{"name":"CVE","id":"CVE-2026-66293","modified":"2026-11-10T17:42:24.114Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-66293"}],"assessments":[{"source":"OSV","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N","score":2.1},{"source":"EEF","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N","score":2.1}],"cve":{"records":[{"id":"CVE-2026-66293","source":"EEF","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-24T14:10:01.114Z","published":"2026-11-06T10:16:42.053Z","modified":"2026-11-10T17:42:24.114Z"}],"publishers":[{"name":"EEF","role":"CNA","organizationId":"6b3ad84c-e1a6-4bf7-a703-f496b71e49db","modified":"2026-11-06T10:16:42.053Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-10T17:42:24.114Z"}],"references":[{"url":"https://github.com/qcam/saxy/security/advisories/GHSA-mm3m-xwmf-v698","tags":["vendor-advisory","related"],"source":"EEF"},{"url":"https://cna.erlef.org/cves/CVE-2026-66293.html","tags":["related"],"source":"EEF"},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-66293","tags":["related"],"source":"EEF"},{"url":"https://github.com/qcam/saxy/commit/7266632e9407842f28ffac254c56dc41210a5690","tags":["related"],"source":"EEF"},{"url":"https://github.com/qcam/saxy/commit/6d12ee12b9e32e86ef598b3f3cafccd1840b2f41","tags":["patch"],"source":"EEF"}],"weaknesses":[{"id":"CWE-91","description":"CWE-91 XML Injection","source":"EEF"}],"applicability":[{"source":"EEF","statements":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:qcam:saxy:*:*:*:*:*:*:*:*","versionEndExcluding":"1.7.0","versionStartIncluding":"0.7.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"AND"}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-10T17:42:07.677044Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"products":[{"vendor":"qcam","name":"saxy","platforms":[],"versions":[{"version":"0.7.0","status":"affected","lessThan":"1.7.0","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:hex/saxy","packageIdentity":{"ecosystem":"Hex","name":"saxy"},"cpes":["cpe:2.3:a:qcam:saxy:*:*:*:*:*:*:*:*"],"source":"EEF","url":"https://www.cve.org/CVERecord?id=CVE-2026-66293"},{"vendor":"qcam","name":"saxy","platforms":[],"versions":[{"version":"7266632e9407842f28ffac254c56dc41210a5690","status":"affected","lessThan":"6d12ee12b9e32e86ef598b3f3cafccd1840b2f41","versionType":"git"}],"defaultStatus":"unaffected","packageURL":"pkg:github/qcam/saxy","cpes":["cpe:2.3:a:qcam:saxy:*:*:*:*:*:*:*:*"],"source":"EEF","url":"https://www.cve.org/CVERecord?id=CVE-2026-66293"}],"remediation":[{"text":"Reject or rewrite the -- sequence in untrusted text before passing it to Saxy.XML.comment/1, for example by replacing -- with - -.\n\nAlternatively, stop emitting untrusted data as XML comments. Comments carry no semantic payload for consumers, so the text can usually be moved into an element or a CDATA section instead.","source":"EEF","url":"https://www.cve.org/CVERecord?id=CVE-2026-66293"}],"observedAt":"2026-11-10T17:52:57.540Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T01:00:31.976Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-06T10:55:33.386Z","attemptedAt":"2026-11-06T10:55:33.386Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-06T10:55:33.727Z","attemptedAt":"2026-11-06T10:55:33.727Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-06T10:55:33.729Z","attemptedAt":"2026-11-06T10:55:33.729Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-06T10:55:33.578Z","attemptedAt":"2026-11-06T10:55:33.578Z"}],"evidence":[],"aiSummary":{"text":"Saxy encoder versions 0.7.0 before 1.7.0 are affected by XML comment injection via unescaped double hyphen, allowing attackers to inject arbitrary markup when untrusted text is serialized as a comment. The attacker must have access to the text being serialized. This may lead to stored cross-site scripting or forged data.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-10T17:56:16.978Z","sources":[{"name":"OSV","url":"https://osv.dev/vulnerability/EEF-CVE-2026-66293"},{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-66293"}]}}