CVE Feed

    Dashboard / CVE / CVE-2026-41650

    CVE-2026-41650

    fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the "-->" sequence in comment content or the "]]>" sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation. This issue has been patched in version 5.7.0.

    Published:May 7, 2026
    Last Modified:May 12, 2026
    EPS:May 7, 2026
    EPSS Score:0.00029
    CVSS Score:6.1

    Affected Products

    Vendor
    Naturalintelligence
    Product
    Fast-xml-parser

    Exploits

    https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-gh4j-gqv2-49f6https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-gh4j-gqv2-49f6

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-250 XML Injection
    CAPEC-83 XPath Injection

    Related CVEs

    CVE-2026-73569 (CVSS 8.7) — fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.…
    CVE-2026-33349 (CVSS 5.9) — fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From ve…
    CVE-2026-33036 (CVSS 7.5) — fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Version…
    CVE-2026-27942 (CVSS 2.7) — fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C+…
    CVE-2026-25896 (CVSS 9.3) — fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C+…
    CVE-2026-26278 (CVSS 7.5) — fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C+…
    CVE-2026-25128 (CVSS 7.5) — fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C+…
    CVE-2024-41818 (CVSS 7.5) — fast-xml-parser is an open source, pure javascript xml parser. a ReDOS exists on currency.js. This vulnerabili…
    CVE-2023-34104 (CVSS 7.5) — fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in en…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High