The vulnerability is caused by the XmlBuilder module’s escape/1 function, which concatenates arbitrary user‑supplied data between <![CDATA[ and ]]> without sanitising embedded CDATA close delimiters. If the input contains the sequence ]], the CDATA section is closed prematurely, and the following bytes are interpreted as normal XML by downstream consumers. This allows an attacker to inject arbitrary XML elements, text, or entity references into the document, potentially leading to content spoofing and the insertion of malicious XML constructs.

The affected product is joshnuss xml_builder, versioning from 0.0.7 up to, but not including, 2.4.1. Any deployment using a version within this range is vulnerable.

The CVSS score of 2.1 classifies this issue as low severity. Exploitation requires the attacker to supply data that is processed by XmlBuilder.generate/1 or generate/2, which typically occurs in applications that serialise user input to XML. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is the application layer, where an attacker can inject a payload containing ]]> to break out of the CDATA section.