The defect is in the xml_builder library’s generate and escape routines. When a literal & is followed by an entity- like token, the library does not escape the & and emits the sequence directly into the XML output. A downstream XML parser then resolves the sequence into the intended characters, turning inert-looking text such as <script> into executable markup. This flaw enables attackers to spoof content and inject cross‑site scripting payloads into any downstream consumer that parses the produced XML and renders it in a markup‑sensitive context, such as HTML, SVG, or RSS feeds. The weakness is classified as CWE-838, Improper Output Encoding.

The strconv library joshnuss xml_builder is affected for all releases from version 0.0.6 up to, but not including, 2.4.1. Users of any preceding or later versions are not vulnerable.

The CVSS score is 2.1, indicating low severity and the EPSS metric is not available, while the vulnerability is not listed in the CISA KEV catalog. Attackers need only supply malicious input to the xml_builder functions, which may occur when user data is emitted as XML. Although the flaw does not grant remote code execution, the potential for XSS and content spoofing can compromise client‑side security and lead to further attacks. The attack path is typically local to the application, but any external party that can influence the XML content could exploit it.