saxy
Hex3 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting saxypage 1 of 1
- CVE-2026-66293LOWCVSS 2.1EG 2.1fixed in 1.7.02026-11-06
vulnerable: 0.10.0 ... 1.6.1 (15 versions)
XML injection in the encoder of Saxy. Saxy.Encoder does not neutralize the -- sequence in XML comment content: escape_comment/2 returns the comment binary unchanged in every clause and only appends a space when the comment ends in a single…
- CVE-2026-66294LOWCVSS 2.1EG 2.1fixed in 1.7.02026-11-06
vulnerable: 0.10.0 ... 1.6.1 (15 versions)
XML injection in the Saxy XML encoder. Saxy.Encoder.cdata/1 serializes a {:cdata, characters} node by wrapping the supplied characters between <![CDATA[ and ]]> and passing the payload through byte for byte. The encoder's character-data an…
- CVE-2026-66295LOWCVSS 2.1EG 2.1fixed in 1.7.02026-11-06
vulnerable: 0.10.0 ... 1.6.1 (15 versions)
Saxy's XML encoder writes the target and the content of a processing instruction into the output document verbatim, without validation or escaping. The encoder builds the construct by concatenating both fields between <? and ?>, so neither…
Check whether saxy is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for saxy CVEs against the assets you own.
Book a Demo →