CVE-2026-53723
guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA Terminator
Description
Guzzle Services provides an implementation of the Guzzle Command library that uses Guzzle service descriptions to describe web services, serialize requests, and parse responses into easy to use model structures. Versions prior ro 1.5.4 do not safely serialize scalar XML element values containing the CDATA terminator `]]>`. The XML request serializer writes values containing `<`, `>`, or `&` with `XMLWriter::writeCData($value)`. If attacker-controlled input contains `]]>`, the CDATA section closes early and the remainder is interpreted as XML markup. This is an outgoing request-body integrity issue, not a response parsing issue. The attacker does not need to control the service description or schema. Users are affected when all of the following are true: the application uses `guzzlehttp/guzzle-services` to serialize outgoing requests; a request parameter or `additionalParameters` schema uses `location: xml`; the value is serialized as XML element text, not an XML attribute; the value can contain attacker-controlled, user-controlled, tenant-controlled, or otherwise untrusted input; the value is not constrained by a safe `enum`, `pattern`, or custom filter that excludes `]]>`; and the downstream service parses the generated XML structurally and may act on unexpected, duplicated, or injected elements. Applications that serialize untrusted input into `location: xml` request parameters can emit XML containing attacker-controlled elements outside the intended text node. Depending on the receiving service, this can alter operation semantics, smuggle privileged fields, bypass modeled parameter boundaries, or create conflicting duplicated elements. Fixed service descriptions are sufficient if they contain an XML element parameter populated from attacker-controlled input. Users are not directly affected if they only use Guzzle Services to deserialize HTTP response bodies. Response XML parsing uses the response XML location visitor and does not invoke the vulnerable request XML serializer. Response bodies matter only in a second-order flow, such as parsing attacker-controlled response XML, storing or forwarding a parsed string value, and later using it as a `location: xml` request parameter. The issue is patched in `1.5.3` and later by safely splitting embedded CDATA terminators before serialization. The fix preserves the original scalar value as XML text and prevents injected nodes. As a workaround, constrain attacker-controlled XML element values with a strict `enum`, `pattern`, or custom filter that excludes `]]>`, or avoid serializing untrusted data into `location: xml` element text until patched. Where appropriate for the service schema, XML attributes are not affected because they are written with XMLWriter attribute APIs rather than CDATA sections. To determine whether action is needed, search service descriptions for request parameters using `location: xml`, including operation `parameters` and `additionalParameters`. Response-only `models` are not directly affected unless parsed values are reused for request serialization. For object and array parameters, review nested scalar properties because leaf element values can still be affected.
INFO
Published Date :
June 11, 2026, 2:16 p.m.
Last Modified :
Oct. 25, 2026, 11:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
Affected Products
The following products are affected by CVE-2026-53723
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Update guzzlehttp/guzzle-services to 1.5.3 or later.
- Constrain XML values with strict patterns or enums.
- Avoid serializing untrusted data into XML element text.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53723.
| URL | Resource |
|---|---|
| https://github.com/guzzle/guzzle-services/security/advisories/GHSA-q8r6-5hfw-5jff |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53723 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53723
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53723 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53723 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 25, 2026
Action Type Old Value New Value Added Translation Title: guzzle-services de guzzle, Description: Guzzle Services proporciona una implementación de la biblioteca Guzzle Command que utiliza descripciones de servicio de Guzzle para describir servicios web, serializar solicitudes y analizar respuestas en estructuras de modelo fáciles de usar. Las versiones anteriores a la 1.5.4 no serializan de forma segura los valores de elementos XML escalares que contienen el terminador CDATA “]]>”. El serializador de solicitudes XML escribe valores que contienen “<”, “>”, o “&” con “XMLWriter::writeCData($value)”. Si la entrada controlada por el atacante contiene “]]>”, la sección CDATA se cierra prematuramente y el resto se interpreta como marcado XML. Este es un problema de integridad del cuerpo de la solicitud saliente, no un problema de análisis de respuesta. El atacante no necesita controlar la descripción del servicio o el esquema. Los usuarios se ven afectados cuando se cumplen todas las siguientes condiciones: la aplicación utiliza “guzzlehttp/guzzle-services” para serializar solicitudes salientes; un parámetro de solicitud o esquema de “additionalParameters” utiliza “location: xml”; el valor se serializa como texto de elemento XML, no como un atributo XML; el valor puede contener entrada controlada por el atacante, controlada por el usuario, controlada por el inquilino o de otro modo no confiable; el valor no está restringido por un “enum”, “pattern” o filtro personalizado seguro que excluya “]]>”; y el servicio descendente analiza el XML generado estructuralmente y puede actuar sobre elementos inesperados, duplicados o inyectados. Las aplicaciones que serializan entrada no confiable en parámetros de solicitud “location: xml” pueden emitir XML que contenga elementos controlados por el atacante fuera del nodo de texto previsto. Dependiendo del servicio receptor, esto puede alterar la semántica de la operación, introducir campos privilegiados, eludir los límites de los parámetros modelados o crear elementos duplicados conflictivos. Las descripciones de servicio corregidas son suficientes si contienen un parámetro de elemento XML poblado a partir de entrada controlada por el atacante. Los usuarios no se ven directamente afectados si solo utilizan Guzzle Services para deserializar cuerpos de respuesta HTTP. El análisis de XML de respuesta utiliza el visitante de ubicación de XML de respuesta y no invoca el serializador de solicitudes XML vulnerable. Los cuerpos de respuesta importan solo en un flujo de segundo orden, como analizar XML de respuesta controlado por el atacante, almacenar o reenviar un valor de cadena analizado y luego usarlo como un parámetro de solicitud “location: xml”. El problema está parcheado en la versión “1.5.3” y posteriores dividiendo de forma segura los terminadores CDATA incrustados antes de la serialización. La corrección preserva el valor escalar original como texto XML y previene nodos inyectados. Como solución alternativa, restrinja los valores de elementos XML controlados por el atacante con un “enum”, “pattern” o filtro personalizado estricto que excluya “]]>”, o evite serializar datos no confiables en texto de elemento “location: xml” hasta que se aplique el parche. Cuando sea apropiado para el esquema de servicio, los atributos XML no se ven afectados porque se escriben con las API de atributos de XMLWriter en lugar de secciones CDATA. Para determinar si se necesita acción, busque en las descripciones de servicio parámetros de solicitud que utilicen “location: xml”, incluyendo “parameters” de operación y “additionalParameters”. Los “models” solo de respuesta no se ven directamente afectados a menos que los valores analizados se reutilicen para la serialización de solicitudes. Para parámetros de objeto y array, revise las propiedades escalares anidadas porque los valores de los elementos hoja aún pueden verse afectados. -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'guzzle', 'product': 'guzzle-services', 'versions': [{'status': 'affected', 'version': '< 1.5.4'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-53723', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-06-11T15:57:24.654072Z'} -
New CVE Received by [email protected]
Jun. 11, 2026
Action Type Old Value New Value Added Description Guzzle Services provides an implementation of the Guzzle Command library that uses Guzzle service descriptions to describe web services, serialize requests, and parse responses into easy to use model structures. Versions prior ro 1.5.4 do not safely serialize scalar XML element values containing the CDATA terminator `]]>`. The XML request serializer writes values containing `<`, `>`, or `&` with `XMLWriter::writeCData($value)`. If attacker-controlled input contains `]]>`, the CDATA section closes early and the remainder is interpreted as XML markup. This is an outgoing request-body integrity issue, not a response parsing issue. The attacker does not need to control the service description or schema. Users are affected when all of the following are true: the application uses `guzzlehttp/guzzle-services` to serialize outgoing requests; a request parameter or `additionalParameters` schema uses `location: xml`; the value is serialized as XML element text, not an XML attribute; the value can contain attacker-controlled, user-controlled, tenant-controlled, or otherwise untrusted input; the value is not constrained by a safe `enum`, `pattern`, or custom filter that excludes `]]>`; and the downstream service parses the generated XML structurally and may act on unexpected, duplicated, or injected elements. Applications that serialize untrusted input into `location: xml` request parameters can emit XML containing attacker-controlled elements outside the intended text node. Depending on the receiving service, this can alter operation semantics, smuggle privileged fields, bypass modeled parameter boundaries, or create conflicting duplicated elements. Fixed service descriptions are sufficient if they contain an XML element parameter populated from attacker-controlled input. Users are not directly affected if they only use Guzzle Services to deserialize HTTP response bodies. Response XML parsing uses the response XML location visitor and does not invoke the vulnerable request XML serializer. Response bodies matter only in a second-order flow, such as parsing attacker-controlled response XML, storing or forwarding a parsed string value, and later using it as a `location: xml` request parameter. The issue is patched in `1.5.3` and later by safely splitting embedded CDATA terminators before serialization. The fix preserves the original scalar value as XML text and prevents injected nodes. As a workaround, constrain attacker-controlled XML element values with a strict `enum`, `pattern`, or custom filter that excludes `]]>`, or avoid serializing untrusted data into `location: xml` element text until patched. Where appropriate for the service schema, XML attributes are not affected because they are written with XMLWriter attribute APIs rather than CDATA sections. To determine whether action is needed, search service descriptions for request parameters using `location: xml`, including operation `parameters` and `additionalParameters`. Response-only `models` are not directly affected unless parsed values are reused for request serialization. For object and array parameters, review nested scalar properties because leaf element values can still be affected. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N Added CWE CWE-20 Added CWE CWE-91 Added Reference https://github.com/guzzle/guzzle-services/security/advisories/GHSA-q8r6-5hfw-5jff