CVE-2026-66293
XML comment injection in Saxy encoder via unescaped double hyphen
What happened?
XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escape_comment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single -, so neither an interior -- nor a full --> is escaped or rejected before the encoder wraps the content in the <!-- and --> delimiters.
When an application serializes attacker-controlled text as a comment, through Saxy.XML.comment/1 or a raw {:comment, text} simple form child, the attacker can close the comment early with --> and inject arbitrary sibling markup into the serialized document. A downstream parser then sees elements, attributes, and text that the application never built. Where the document is rendered as HTML or SVG, the injected markup executes as stored cross-site scripting; where it is consumed by another XML processor, the attacker can forge data that the producing application never emitted. Documents that Saxy only parses are not a vector.
This issue affects saxy: from 0.7.0 before 1.7.0.
Affected software and versions
| Software | Version information | Fixed version |
|---|---|---|
| saxyqcam | affected: 0.7.0 to < 1.7.0 | See vendor advisory |
| qcam/saxyqcam | affected: 7266632e9407842f28ffac254c56dc41210a5690 to < 6d12ee12b9e32e86ef598b3f3cafccd1840b2f41 | See vendor advisory |
Version information comes from the source record and can include unaffected products and exceptions. Distribution packages may contain backported fixes: an older upstream version alone does not prove a server is affected.
Is it being exploited?
This CVE was not listed in the CISA catalogue at our last retrieval. This does not establish that exploitation is absent.
How to respond
- Confirm the product, installed package version, and any configuration requirements in the vendor advisory.
- Follow the vendor’s remediation or workaround guidance in the references below. Structured fixed-version data is unavailable here; the publisher’s description may include a fix or workaround.
- Restart affected services if required, then verify the running version. Known exploitation may warrant investigation as well as patching.
Sources and remediation references
- https://www.cve.org/CVERecord?id=CVE-2026-66293
- https://github.com/qcam/saxy/security/advisories/GHSA-mm3m-xwmf-v698
- https://cna.erlef.org/cves/CVE-2026-66293.html
- https://osv.dev/vulnerability/EEF-CVE-2026-66293
- https://github.com/qcam/saxy/commit/7266632e9407842f28ffac254c56dc41210a5690
- https://github.com/qcam/saxy/commit/6d12ee12b9e32e86ef598b3f3cafccd1840b2f41