A flaw in the xml_builder library causes element names, attribute names, and doctype identifiers to be inserted into serialized XML without escaping structural characters. As a result an attacker who can control a name argument can inject arbitrary XML markup, including extra elements, comments, and event‑handler attributes. The impact is the possibility of presenting or processing false or malicious content to downstream consumers of the XML. This weakness is classified as CWE‑91 (Improper Neutralization of Special Elements in HTML/XML).

The vulnerability affects the joshnuss xml_builder package, versions 0.0.1 through 2.4.0. All installed instances of the library in that range are susceptible.

The CVSS score is 2.1, indicating low severity. No EPSS score is available and the vulnerability is not listed in CISA's KEV catalog. The attack requires the ability to influence a name argument, which is typically possible from untrusted input such as JSON keys or HTTP form field names. An attacker can therefore embed arbitrary markup into the generated XML document, potentially subverting downstream consumers. Exploitation is low probability without further context, but the lack of escaping means the vulnerability is trivial to exploit once an input path exists.