---
id: "CVE-2026-66293"
page: "https://infrastack.ai/live/CVE-2026-66293"
kind: "vulnerability"
aliases: ["CVE-2026-66293"]
title: "Saxy: XML comments let attacker-supplied text inject markup"
severity: "low"
cvss: 2.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["elixir", "package", "saxy", "xml"]
not_affected_if: ["no-untrusted-comment-text", "parse-only", "saxy-1.7.0-or-later"]
published_at: "2026-11-06T11:17:16+00:00"
first_seen_at: "2026-11-06T11:41:29+00:00"
updated_at: "2026-11-06T11:44:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66293", "first_seen_at": "2026-11-06T11:41:29+00:00"}]
exploit_sources: []
---

# Saxy: XML comments let attacker-supplied text inject markup

Link for people: https://infrastack.ai/live/CVE-2026-66293 (this .md is for agents)

Saxy is an Elixir XML library whose encoder does not escape the -- sequence or --> inside comment content. An attacker who controls text serialized as a comment can close the comment early and inject arbitrary elements that downstream parsers or browsers will treat as real markup.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for `saxy` in `mix.lock` and note the locked version.
- Search the codebase for `Saxy.XML.comment(` and for `{:comment,` in simple form children, and check whether any attacker-controlled text reaches them.

## Fix

- `saxy` moves to `1.7.0` or later (affected range: from `0.7.0` before `1.7.0`).

## Timeline

- 2026-11-06T11:41:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-66293

## Documents

- [advisory] Vendor advisory: github.com https://github.com/qcam/saxy/security/advisories/GHSA-mm3m-xwmf-v698
- [fix] Patch: github.com https://github.com/qcam/saxy/commit/6d12ee12b9e32e86ef598b3f3cafccd1840b2f41
- [fix] Patch: github.com https://github.com/qcam/saxy/commit/7266632e9407842f28ffac254c56dc41210a5690

## From the sources

XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escape_comment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an interior -- nor a full --> is escaped or rejected before the encoder wraps the content in the <!-- and --> delimiters.

When an application serializes attacker-controlled text as a comment, through Saxy.XML.comment/1 or a raw {:comment, text} simple form child, the attacker can close the comment early with --> and inject arbitrary sibling markup into the serialized document. A downstream parser then sees elements, attributes, and text that the application never built. Where the document is rendered as HTML or SVG, the injected markup executes as stored cross-site scripting; where it is consumed by another XML processor, the attacker can forge data that the producing application never emitted. Documents that Saxy only parses are not a vector.

This issue affects saxy: from 0.7.0 before 1.7.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_