{"action":"Upgrade xml_builder to 2.4.1 or later.","affected":[{"fixed":"2.4.1","introduced":"0.0.1"}],"component":"xml_builder","cve_ids":["CVE-2026-48590"],"ecosystem":"Hex","epss":0.00226,"exploited":false,"fixed_versions":["2.4.1"],"ghsa_id":"GHSA-r82p-3q2p-728w","id":"tcs_01M5N854HZ4N40FMZW8A1J12RQ","modified_at":"2026-09-08T05:30:35.349570464Z","published_at":"2026-08-21T09:51:25.412Z","references":["https://osv.dev/vulnerability/EEF-CVE-2026-48590","https://github.com/joshnuss/xml_builder/security/advisories/GHSA-r82p-3q2p-728w","https://cna.erlef.org/cves/CVE-2026-48590.html","https://github.com/joshnuss/xml_builder/commit/d5c0aec32a8eecbb440fb9bbb0f59d4d188d5859","https://hex.pm/packages/xml_builder"],"severity":{"label":"low","score":2.1},"sources":[{"source":"osv","source_id":"EEF-CVE-2026-48590","url":"https://osv.dev/vulnerability/EEF-CVE-2026-48590"},{"source":"nvd","source_id":"CVE-2026-48590","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48590"}],"summary":"Element and Attribute Names Injected Verbatim into XML Output in xml_builder"}