CVE-2026-53723

@@ -1,5 +1,9 @@
 # CHANGELOG
 
+## 1.5.4 - Upcoming
+
+* Prevent XML CDATA injection during request serialization (GHSA-q8r6-5hfw-5jff)
+
 ## 1.5.3 - 2026-06-02
 
 * Harden request serialization state after failures

@@ -217,13 +217,28 @@ protected function writeElement(\XMLWriter $writer, $prefix, $name, $namespace,
             $writer->startElement($name);
         }
         if ($value !== null && strpbrk($value, '<>&')) {
-            $writer->writeCData($value);
+            $this->writeSafeCData($writer, $value);
         } else {
             $writer->writeRaw($value);
         }
         $writer->endElement();
     }
 
+    protected function writeSafeCData(\XMLWriter $writer, $value)
+    {
+        $parts = explode(']]>', $value);
+        $last = array_pop($parts);
+
+        foreach ($parts as $part) {
+            $writer->writeCData($part.']]');
+            $writer->writeCData('>');
+        }
+
+        if ($last !== '') {
+            $writer->writeCData($last);
+        }
+    }
+
     /**
      * Create a new xml writer and start a document
      *

@@ -524,4 +524,57 @@ public function testSerializesXml(array $operation, array $input, $xml)
             $this->assertEquals($xml, $body);
         }
     }
+
+    /**
+     * @group RequestLocation
+     */
+    public function testSplitsCDataTerminatorsToPreventXmlInjection()
+    {
+        $payload = 'x]]></Foo><Injected attr="1"/><Foo><![CDATA[y';
+        $document = simplexml_load_string($this->serializeXmlValue($payload));
+
+        $this->assertNotFalse($document);
+        $this->assertCount(1, $document->Foo);
+        $this->assertCount(0, $document->Injected);
+        $this->assertSame($payload, (string) $document->Foo);
+    }
+
+    public function cdataTerminatorProvider()
+    {
+        return [
+            ['a]]>b'],
+            ['abc]]>'],
+            [']]>'],
+        ];
+    }
+
+    /**
+     * @dataProvider cdataTerminatorProvider
+     *
+     * @group RequestLocation
+     */
+    public function testPreservesTextContainingCDataTerminators($value)
+    {
+        $document = simplexml_load_string($this->serializeXmlValue($value));
+
+        $this->assertNotFalse($document);
+        $this->assertSame($value, (string) $document->Foo);
+    }
+
+    private function serializeXmlValue($value)
+    {
+        $location = new XmlLocation();
+        $command = new Command('foo', ['Foo' => $value]);
+        $request = new Request('POST', 'http://httbin.org');
+        $param = new Parameter([
+            'name' => 'Foo',
+            'location' => 'xml',
+            'type' => 'string',
+        ]);
+
+        $location->visit($command, $request, $param);
+        $request = $location->after($command, $request, new Operation());
+
+        return (string) $request->getBody();
+    }
 }