CVE-2026-44664

MediumCVSS 6.1

Published: 13/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

In fast-xml-builder 1.1.5, the fix for CVE-2026-41650 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace(/--/g, '- -'). This skips values containing three consecutive dashes (e.g., --->...), allowing an attacker to break out of an XML comment and inject arbitrary XML/HTML content. This vulnerability is fixed in 1.1.6.

Risk Assessment

An attacker can inject arbitrary XML/HTML content into the generated document, potentially leading to injection attacks. This may result in malicious code execution or content spoofing.

Recommendation

Update fast-xml-builder to version 1.1.6 or later. Verify that the fast-xml-parser version in use includes the appropriate fixes.

Other vulnerabilities in fast-xml-builder

CVE-2026-44665Medium
fast-xml-builder builds XML from JSON. Prior to 1.1.7, when input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into multiple attributes. This gives room for an attacker to insert unwanted attributes into the XML/HTML. This vulnerability is fixed in 1.1.7.

Original NVD description (English source)

fast-xml-builder builds XML from JSON. In 1.1.5, the fix for CVE-2026-41650 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace(/--/g, '- -'). This skip the values containing three consecutive dashes (e.g., --->...), allowing an attacker to break out of an XML comment and inject arbitrary XML/HTML content. This vulnerability is fixed in 1.1.6.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS