guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA Terminator
guzzlehttp/guzzle-services does not safely serialize scalar XML element values containing the CDATA terminator ]]>. The XML request serializer writes values containing <, >, or & with XMLWriter::writeCData($value). If attacker-controlled input contains ]]>, the CDATA section closes early and the remainder is interpreted as XML markup. This is an outgoing request-body integrity issue, not a response parsing issue. The attacker does not need to control the service description or schema. Users …