{"id":"CVE-2026-44664","aliases":["EUVD-2026-30052","GHSA-45c6-75p6-83cc","ROOT-APP-NPM-CVE-2026-44664"],"status":"published","title":"fast-xml-builder: Comment Value bypass regex","description":"fast-xml-builder builds XML from JSON. In 1.1.5, the fix for CVE-2026-41650 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace(/--/g, '- -'). This skip the values containing three consecutive dashes (e.g., ---\u003e...), allowing an attacker to break out of an XML comment and inject arbitrary XML/HTML content. This vulnerability is fixed in 1.1.6.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00194,"percentile":0.09153,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-91"],"published":"2026-05-08T16:27:28Z","modified":"2026-10-28T02:30:32Z","fixes":[{"ecosystem":"npm","package":"fast-xml-builder","fixed_in":["1.1.6"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"@rootio/fast-xml-builder","fixed_in":["1.1.5-root.io.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"fast-xml-builder","fixed_in":["1.1.5-aikido.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"fast-xml-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.5"},{"last_affected":"1.1.5"},{"fixed":"1.1.6"}]}],"versions":["1.1.5"]},{"source":"osv","ecosystem":"npm","package":"fast-xml-builder","ranges":[{"type":"SEMVER","events":[{"introduced":"1.1.5"},{"fixed":"1.1.6"}]}],"versions":["1.1.5"]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/fast-xml-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.5-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"fast-xml-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.5-aikido.3"}]}]}],"products":[{"vendor":"naturalintelligence","product":"fast-xml-builder"}],"references":[{"url":"https://github.com/NaturalIntelligence/fast-xml-builder/security/advisories/GHSA-45c6-75p6-83cc","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-gh4j-gqv2-49f6","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44664","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-45c6-75p6-83cc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44664.json","tags":["advisory"]},{"url":"https://github.com/NaturalIntelligence/fast-xml-builder","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-44664","title":"fast-xml-builder: Comment Value bypass regex","description":"fast-xml-builder builds XML from JSON. In 1.1.5, the fix for CVE-2026-41650 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace(/--/g, '- -'). This skip the values containing three consecutive dashes (e.g., ---\u003e...), allowing an attacker to break out of an XML comment and inject arbitrary XML/HTML content. This vulnerability is fixed in 1.1.6.","status":"published","published":"2026-05-13T15:27:34.716Z","modified":"2026-05-13T16:46:25.862Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-91"],"updated_at":"2026-11-02T13:42:49.132798Z"}],"euvd":[{"id":"EUVD-2026-30052","description":"fast-xml-builder builds XML from JSON. In 1.1.5, the fix for CVE-2026-41650 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace(/--/g, '- -'). This skip the values containing three consecutive dashes (e.g., ---\u003e...), allowing an attacker to break out of an XML comment and inject arbitrary XML/HTML content. This vulnerability is fixed in 1.1.6.","status":"published","published":"2026-05-13T15:27:34Z","modified":"2026-05-13T16:46:25Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:04:33.260537Z"}],"ghsa":[{"id":"GHSA-45c6-75p6-83cc","title":"fast-xml-builder Comment Value regex can be bypassed","description":"# Summary\nThe fix for https://github.com/advisories/GHSA-gh4j-gqv2-49f6 in fast-xml-parser sanitizes `--` sequences in XML comment content using .replace(/--/g, '- -'). This skip the values containing three consecutive dashes (e.g., ---\u003e...), allowing an attacker to break out of an XML comment and inject arbitrary XML/HTML content.\n\n### Impact\nAny application with comment property enabled allow attacker to inject malicious or unwanted code like JS script tag in the XML/HTML output.\n\n### Workarounds\nCheck for the presence of 3 consecutive dashes externally in the property value used for comment tag.","status":"published","published":"2026-05-08T16:27:28Z","modified":"2026-05-14T20:37:34Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-91"],"updated_at":"2026-11-02T14:40:09.033429Z"}],"nvd":[{"id":"CVE-2026-44664","description":"fast-xml-builder builds XML from JSON. In 1.1.5, the fix for CVE-2026-41650 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace(/--/g, '- -'). This skip the values containing three consecutive dashes (e.g., ---\u003e...), allowing an attacker to break out of an XML comment and inject arbitrary XML/HTML content. This vulnerability is fixed in 1.1.6.","status":"published","published":"2026-05-13T16:16:58.937Z","modified":"2026-10-26T18:10:00.173Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-91"],"updated_at":"2026-11-02T14:12:19.020465Z"}],"osv":[{"id":"CVE-2026-44664","title":"fast-xml-builder: Comment Value bypass regex","description":"fast-xml-builder builds XML from JSON. In 1.1.5, the fix for CVE-2026-41650 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace(/--/g, '- -'). This skip the values containing three consecutive dashes (e.g., ---\u003e...), allowing an attacker to break out of an XML comment and inject arbitrary XML/HTML content. This vulnerability is fixed in 1.1.6.","status":"published","published":"2026-05-13T15:27:34.716Z","modified":"2026-10-28T02:30:32.344193741Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-91"],"updated_at":"2026-11-02T15:45:05.172514Z"},{"id":"GHSA-45c6-75p6-83cc","title":"fast-xml-builder Comment Value regex can be bypassed","description":"# Summary\nThe fix for https://github.com/advisories/GHSA-gh4j-gqv2-49f6 in fast-xml-parser sanitizes `--` sequences in XML comment content using .replace(/--/g, '- -'). This skip the values containing three consecutive dashes (e.g., ---\u003e...), allowing an attacker to break out of an XML comment and inject arbitrary XML/HTML content.\n\n### Impact\nAny application with comment property enabled allow attacker to inject malicious or unwanted code like JS script tag in the XML/HTML output.\n\n### Workarounds\nCheck for the presence of 3 consecutive dashes externally in the property value used for comment tag.","status":"published","published":"2026-05-08T16:27:28Z","modified":"2026-09-10T03:51:04.584520301Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-91"],"updated_at":"2026-11-02T15:46:36.434231Z"},{"id":"ROOT-APP-NPM-CVE-2026-44664","title":"CVE-2026-44664 in @rootio/fast-xml-builder - Patched by Root","description":"Root has patched CVE-2026-44664 in the @rootio/fast-xml-builder package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-06-09T13:45:32Z","modified":"2026-06-09T19:30:07.516572997Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:27.649662Z"}]}}