CVE-2026-41650
published 2026-05-07CVE-2026-41650: fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the…
PriorityP430medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.27%
18.5th percentile
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the "-->" sequence in comment content or the "]]>" sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation. This issue has been patched in version 5.7.0.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| advanced-cluster-security | rhacs-main-rhel8 | — | — |
| ansible-automation-platform | automation-portal | — | — |
| apicurio | apicurio-registry-ui-rhel8 | — | — |
| apicurio | apicurio-registry-ui-rhel9 | — | — |
| container-native-virtualization | kubevirt-console-plugin | — | — |
| container-native-virtualization | kubevirt-console-plugin-rhel9 | — | — |
| mta | mta-ui-rhel8 | — | — |
| mta | mta-ui-rhel9 | — | — |
| naturalintelligence | fast-xml-builder | — | — |
| naturalintelligence | fast-xml-parser | < 5.7.0 | 5.7.0 |
| naturalintelligence | fast-xml-parser | >= 0 < 5.7.0 | 5.7.0 |
| odf4 | mcg-core-rhel8 | — | — |
| odf4 | mcg-core-rhel9 | — | — |
| odf4 | ocs-client-console-rhel9 | — | — |
| odf4 | odf-console-rhel9 | — | — |
| odf4 | odf-multicluster-console-rhel9 | — | — |
| openshift-gitops-1 | argocd-rhel8 | — | — |
| openshift-gitops-1 | argocd-rhel9 | — | — |
| rhdh | rhdh-hub-rhel9 | — | — |
| satellite | iop-vulnerability-frontend-rhel9 | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
ghsa6.5MEDIUM
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
fast-xml-parser: fast-xml-parser: XML injection via improper escaping of comment and CDATA sequences
vendor_redhat·2026-05-07·CVSS 6.1
CVE-2026-41650 [MEDIUM] CWE-91 fast-xml-parser: fast-xml-parser: XML injection via improper escaping of comment and CDATA sequences
fast-xml-parser: fast-xml-parser: XML injection via improper escaping of comment and CDATA sequences
A flaw was found in fast-xml-parser. The XMLBuilder component does not properly escape specific sequences ("-->" in comments and "]]>" in CDATA sections) when constructing XML from JavaScript objects. This vulnerability allows an attacker to perform XML injection if user-controlled data is processed within comments or CDATA elements. Successful exploitation can lead to Cross-Site Scripting (XSS), SOAP injection, or unauthorized data manipulation.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
VulDB
NaturalIntelligence fast-xml-parser up to 5.6.x CDATA Section xml injection
vuldb·2026-05-07·CVSS 6.1
CVE-2026-41650 [MEDIUM] NaturalIntelligence fast-xml-parser up to 5.6.x CDATA Section xml injection
A vulnerability was found in NaturalIntelligence fast-xml-parser up to 5.6.x. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component CDATA Section. The manipulation results in xml injection.
This vulnerability was named CVE-2026-41650. The attack may be performed from remote. There is no available exploit.
It is recommended to upgrade the affected component.
GHSA
fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters
ghsa·2026-04-22·CVSS 6.5
CVE-2026-41650 [MEDIUM] CWE-91 fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters
fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters
# fast-xml-parser XMLBuilder: Comment and CDATA Injection via Unescaped Delimiters
## Summary
fast-xml-parser XMLBuilder does not escape the `-->` sequence in comment content or the `]]>` sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation.
Existing CVEs for fast-xml-parser cover different issues:
- CVE-2023-26920: Prototype pollution (parser)
- CVE-2023-34104: ReDoS (parser)
- CVE-2026-27942: Stack overflow in XMLBuilder with preserveOrder
- CVE-2026-25896: Entity encoding bypass via regex in DOCTYPE entities
This finding covers **unescaped
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-44664 fast-xml-builder: fast-xml-builder: Arbitrary XML/HTML injection via insufficient sanitization of XML comments
bugzilla·2026-05-13·CVSS 6.1
CVE-2026-44664 [MEDIUM] CVE-2026-44664 fast-xml-builder: fast-xml-builder: Arbitrary XML/HTML injection via insufficient sanitization of XML comments
CVE-2026-44664 fast-xml-builder: fast-xml-builder: Arbitrary XML/HTML injection via insufficient sanitization of XML comments
fast-xml-builder builds XML from JSON. In 1.1.5, the fix for CVE-2026-41650 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace(/--/g, '- -'). This skip the values containing three consecutive dashes (e.g., --->...), allowing an attacker to break out of an XML comment and inject arbitrary XML/HTML content. This vulnerability is fixed in 1.1.6.
Bugzilla
CVE-2026-41650 fast-xml-parser: fast-xml-parser: XML injection via improper escaping of comment and CDATA sequences
bugzilla·2026-05-07·CVSS 6.1
CVE-2026-41650 [MEDIUM] CVE-2026-41650 fast-xml-parser: fast-xml-parser: XML injection via improper escaping of comment and CDATA sequences
CVE-2026-41650 fast-xml-parser: fast-xml-parser: XML injection via improper escaping of comment and CDATA sequences
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the "-->" sequence in comment content or the "]]>" sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation. This issue has been patched in version 5.7.0.
2026-05-07
Published