Read the docs
TI-2026-32565 Aliases CVE-2026-44665GHSA-5wm8-gmm8-39j9

fast-xml-builder: Attribute values with unwanted quotes can bypass malicious or unwanted attributes

Priority MEDIUM 60CWE-91Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 1 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

fast-xml-builder builds XML from JSON. Prior to 1.1.7, when an input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into multiple attributes. This gives the room for an attacker to insert unwanted attributes to the XML/HTML. This vulnerability is fixed in 1.1.7.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00236 14th percentileScored 2026-11-07
Fix Partial fast-xml-builder (NaturalIntelligence): 1.1.7fast-xml-builder (npm): 1.1.7Red Hat: 1 advisoryRed Hat: 1 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NaturalIntelligencefast-xml-builderbefore 1.1.71.1.7Patch availableCNA
—fast-xml-builder (npm)before 1.1.71.1.7Patch availableGHSA-5wm8-gmm8-39j9
  • fast-xml-builder VendorNaturalIntelligence Affected before 1.1.7 Fixed in 1.1.7 Patch available CNA
  • fast-xml-builder (npm) Vendor— Affected before 1.1.7 Fixed in 1.1.7 Patch available GHSA-5wm8-gmm8-39j9

Remediation

  • Fix · CNA fast-xml-builder (NaturalIntelligence) Fixed in 1.1.7
  • Fix · GHSA-5wm8-gmm8-39j9 fast-xml-builder (npm) Fixed in 1.1.7 Advisory →

Red Hat 1 advisory

  • RHSA-2026:56928 Released 2026-08-19 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.22.2 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +25

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Advanced Cluster Security 4AffectedNo fix planned: Out of support scope
Red Hat Developer Hub 1AffectedNo fix yet: Fix deferred
Red Hat OpenShift Virtualization 4AffectedNo fix planned: Out of support scope
Self-service automation portal 2AffectedNo fix yet: Fix deferred
Red Hat Openshift Data Foundation 4.22Fixed RHSA-2026:56928
Not affected: 2 products
  • Red Hat OpenShift Virtualization 4
  • Red Hat Openshift Data Foundation 4.22

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44665
  2. 2026-10-03 Alias added: GHSA-5wm8-gmm8-39j9
  3. 2026-10-27 Affected versions changed · Red Hat

References

Advisory 1

Other 2

  • TI-2026-20935 fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names CVSS 3.1CRITICAL 9.3
  • TI-2026-25482 fast-xml-parser affected by numeric entity expansion bypassing all entity expansion… CVSS 3.1HIGH 7.5
  • TI-2026-20291 fast-xml-parser has RangeError DoS Numeric Entities Bug CVSS 3.1HIGH 7.5
  • TI-2026-30169 fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters CVSS 3.1MEDIUM 6.1
  • TI-2026-25755 fast-xml-parser: Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation CVSS 3.1MEDIUM 5.9
  • TI-2026-51659 fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits CVSS 4.0HIGH 8.7
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences