Skip to content
OpenAdvisories

Package · Hex

saxy

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Low 2.1
    CVE-2026-66294

    XML injection in Saxy via unescaped CDATA section terminator

    XML injection in the Saxy XML encoder. Saxy.Encoder.cdata/1 serializes a {:cdata, characters} node by wrapping the supplied characters between <![CDATA[ and ]]> and passing the payload through byte for byte. The encoder's character-data and attribute-value pa…

    qcam saxy saxy Hex
  • Low 2.1
    CVE-2026-66295

    Processing instruction target and content emitted unescaped in Saxy encoder allows XML injection

    Saxy's XML encoder writes the target and the content of a processing instruction into the output document verbatim, without validation or escaping. The encoder builds the construct by concatenating both fields between <? and ?>, so neither field is checked ag…

    qcam saxy saxy Hex
  • Low 2.1
    CVE-2026-66293

    XML comment injection in Saxy encoder via unescaped double hyphen

    XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escape_comment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an in…

    qcam saxy saxy Hex