CVE-2026-41650
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
fast-xml-parser prior to version 5.7.0 does not escape the "-->" sequence in comments or the "]]>" sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection, leading to XSS, SOAP injection, or data manipulation.
Risk Assessment
Potential XML injection via user-controlled data may lead to XSS, SOAP injection, or data manipulation.
Recommendation
Update fast-xml-parser to version 5.7.0 or later. Review applications processing XML for user input.
Other vulnerabilities in fast-xml-parser
See all- CVE-2026-25896Critical
In fast-xml-parser versions 4.1.3 through before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered.
- CVE-2026-73569High
fast-xml-parser versions 5.9.3 through 5.10.1 have a vulnerability related to processing multiple DOCTYPE declarations in a single XML document. The addInputEntities() function resets entity expansion limits on each call, allowing bypass of protections and potentially causing excessive CPU usage, event-loop blocking, memory exhaustion, and process termination. The issue is fixed in version 5.10.1.
- CVE-2026-26278High
A vulnerability in the fast-xml-parser library allows a DoS attack via unlimited entity expansion. Even a small XML file can cause prolonged processing and freeze the application.
- CVE-2023-34104High
fast-xml-parser is an open source, pure JavaScript XML parser that allows special characters in entity names, which are not properly escaped. An attacker can exploit this vulnerability to perform denial of service (DoS) attacks by crafting entity names that generate inefficient regular expressions.
Original NVD description (English source)
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the "-->" sequence in comment content or the "]]>" sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation. This issue has been patched in version 5.7.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS