CVE-2026-44665

MediumCVSS 6.1

Published: 13/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

fast-xml-builder builds XML from JSON. Prior to 1.1.7, when input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into multiple attributes. This gives room for an attacker to insert unwanted attributes into the XML/HTML. This vulnerability is fixed in 1.1.7.

Risk Assessment

An attacker can inject additional attributes into generated XML/HTML, potentially leading to document structure manipulation, validation bypass, or injection attacks in applications consuming the output. The risk depends on the context in which the generated XML is used.

Recommendation

Update fast-xml-builder to version 1.1.7 or later. Additionally, validate input before building XML and consider escaping quotes in attribute values.

Other vulnerabilities in fast-xml-builder

CVE-2026-44664Medium
In fast-xml-builder 1.1.5, the fix for CVE-2026-41650 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace(/--/g, '- -'). This skips values containing three consecutive dashes (e.g., --->...), allowing an attacker to break out of an XML comment and inject arbitrary XML/HTML content. This vulnerability is fixed in 1.1.6.

Original NVD description (English source)

fast-xml-builder builds XML from JSON. Prior to 1.1.7, when an input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into multiple attributes. This gives the room for an attacker to insert unwanted attributes to the XML/HTML. This vulnerability is fixed in 1.1.7.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS