fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters
Priority MEDIUM 60CWE-91Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 2 fixed, 10 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the "-->" sequence in comment content or the "]]>" sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation. This issue has been patched in version 5.7.0.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00238 14th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial fast-xml-parser (NaturalIntelligence): 5.7.0fast-xml-parser (npm): 5.7.0Red Hat: 2 advisoriesRed Hat: 2 fixed, 10 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NaturalIntelligence | fast-xml-parser | before 5.7.0 | 5.7.0 | Patch available | CNA |
| — | fast-xml-parser (npm) | before 5.7.0 | 5.7.0 | Patch available | GHSA-gh4j-gqv2-49f6 |
- fast-xml-parser VendorNaturalIntelligence Affected before 5.7.0 Fixed in 5.7.0 Patch available CNA
- fast-xml-parser (npm) Vendor— Affected before 5.7.0 Fixed in 5.7.0 Patch available GHSA-gh4j-gqv2-49f6
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:* | before 5.7.0 | Vulnerable | NaturalIntelligence |
- cpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:* Versions before 5.7.0 Vulnerable ·NaturalIntelligence
Remediation
- Fix · CNA fast-xml-parser (NaturalIntelligence) Fixed in 5.7.0
- Fix · GHSA-gh4j-gqv2-49f6 fast-xml-parser (npm) Fixed in 5.7.0 Advisory →
Red Hat 2 advisories
- RHSA-2026:56928 Released 2026-08-19 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.22.2 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +25
- RHSA-2026:56431 Released 2026-08-18 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.18.27 security, enhancement & bug fix update
- Red Hat Openshift Data Foundation 4.18 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +16
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 4 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Applications 8 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet: Fix deferred |
| Red Hat Developer Hub 1 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift GitOps | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet: Fix deferred |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet: Fix deferred |
| Self-service automation portal 2 | Affected | No fix yet: Fix deferred |
| Red Hat Openshift Data Foundation 4.18 | Fixed | RHSA-2026:56431 |
| Red Hat Openshift Data Foundation 4.22 | Fixed | RHSA-2026:56928 |
Not affected: 2 products
- Red Hat Openshift Data Foundation 4.18
- Red Hat Openshift Data Foundation 4.22
Timeline
- 2026-10-02 Threatist record created from CVE-2026-41650
- 2026-10-03 Alias added: GHSA-gh4j-gqv2-49f6
- 2026-10-27 Affected versions changed · Red Hat
References
More NaturalIntelligence Fast-xml-parser vulnerabilities
- TI-2026-20935 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names CVSS 3.1CRITICAL 9.3
- TI-2026-25482 fast-xml-parser affected by numeric entity expansion bypassing all entity expansion… CVSS 3.1HIGH 7.5
- TI-2026-20291 fast-xml-parser has RangeError DoS Numeric Entities Bug CVSS 3.1HIGH 7.5
- TI-2026-25755 fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation CVSS 3.1MEDIUM 5.9
- TI-2026-21247 fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) CVSS 3.1HIGH 7.5
- TI-2024-27861 ReDOS at currency parsing fast-xml-parser CVSS 3.1HIGH 7.5
Sources
- CVE-2026-41650 · CVE Program
- CVE-2026-41650 · NVD
- FIRST EPSS
- GHSA-gh4j-gqv2-49f6 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-41650 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences