Skip to content
cve.newCreate a CVE report

saxy

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

low2.1
CVE-2026-66294Package fixes recorded

XML injection in Saxy via unescaped CDATA section terminator

XML injection in the Saxy XML encoder. Saxy.Encoder.cdata/1 serializes a {:cdata, characters} node by wrapping the supplied characters between <![CDATA[ and ]]> and passing the payload through byte for byte. The encoder's character-data and attribute-value paths escape the XML metacharacters <, >, &, ", and ', but the CDATA path applies no neutralization at all. XML provides no character escaping mechanism inside a CDATA section, so the only correct way to represent a ]]> substring is to split the section and rejoin it as ]]]]><![CDATA[>. Saxy neither performs that split nor rejects the substring.

Recorded fixes — saxy: 1.7.0. Check your release branch.

Exploitation not established

Hex / saxy
saxy Hex
Affected range Recorded fix
From 0.7.0 before 1.7.0Semantic versions1.7.0

Version evidence: OSV · EEF-CVE-2026-66294

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.7.0"
        },
        {
          "fixed": "1.7.0"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": [
    "0.10.0",
    "0.7.0",
    "0.8.0",
    "0.9.0",
    "0.9.1",
    "1.0.0",
    "1.1.0",
    "1.2.0",
    "1.2.1",
    "1.2.2",
    "1.3.0",
    "1.4.0",
    "1.5.0",
    "1.6.0",
    "1.6.1"
  ]
}
low2.1
CVE-2026-66295Package fixes recorded

Processing instruction target and content emitted unescaped in Saxy encoder allows XML injection

Saxy's XML encoder writes the target and the content of a processing instruction into the output document verbatim, without validation or escaping. The encoder builds the construct by concatenating both fields between <? and ?>, so neither field is checked against the constraints the XML specification places on it.

Recorded fixes — saxy: 1.7.0. Check your release branch.

Exploitation not established

Hex / saxy
saxy Hex
Affected range Recorded fix
From 0.7.0 before 1.7.0Semantic versions1.7.0

Version evidence: OSV · EEF-CVE-2026-66295

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.7.0"
        },
        {
          "fixed": "1.7.0"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": [
    "0.10.0",
    "0.7.0",
    "0.8.0",
    "0.9.0",
    "0.9.1",
    "1.0.0",
    "1.1.0",
    "1.2.0",
    "1.2.1",
    "1.2.2",
    "1.3.0",
    "1.4.0",
    "1.5.0",
    "1.6.0",
    "1.6.1"
  ]
}
low2.1
CVE-2026-66293Package fixes recorded

XML comment injection in Saxy encoder via unescaped double hyphen

XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escape_comment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an interior -- nor a full --> is escaped or rejected before the encoder wraps the content in the <!-- and --> delimiters.

Recorded fixes — saxy: 1.7.0. Check your release branch.

Exploitation not established

Hex / saxy
saxy Hex
Affected range Recorded fix
From 0.7.0 before 1.7.0Semantic versions1.7.0

Version evidence: OSV · EEF-CVE-2026-66293

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0.7.0"
        },
        {
          "fixed": "1.7.0"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": [
    "0.10.0",
    "0.7.0",
    "0.8.0",
    "0.9.0",
    "0.9.1",
    "1.0.0",
    "1.1.0",
    "1.2.0",
    "1.2.1",
    "1.2.2",
    "1.3.0",
    "1.4.0",
    "1.5.0",
    "1.6.0",
    "1.6.1"
  ]
}