9.3
Critical
CVE-2026-25896 fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based…
Description
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Advanced Cluster Security for Kubernetes 4.8 1775594119 | earliest → < 1775594119 | 1775594119 |
| Red Hat Advanced Cluster Security for Kubernetes 4.9 1775594284 | earliest → < 1775594284 | 1775594284 |
| Red Hat Developer Hub 1.8 1774545605 | earliest → < 1774545605 | 1774545605 |
| Red Hat Developer Hub 1.9 1775140647 | earliest → < 1775140647 | 1775140647 |
| Migration Toolkit for Applications 8 | Versions not published | |
| Red Hat Openshift Data Foundation 4 | Versions not published | |
| Red Hat OpenShift GitOps | Versions not published | |
| Red Hat OpenShift Virtualization 4 | Versions not published | |
| Red Hat Satellite 6 | Versions not published |
Show the 10 other branches Hide the 10 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Self-service automation portal 2 | Versions not published | |
| fast-xml-parser 5.0 | 5.0.0 → < 5.3.5 | 5.3.5 |
| fast-xml-parser 4.1 | 4.1.3 → < 4.5.4 | 4.5.4 |
| Red Hat Openshift Data Foundation 4.20 1783669219 | earliest → < 1783669219 | 1783669219 |
| Red Hat Advanced Cluster Security 4.8 1775594119 | earliest → < 1775594119 | 1775594119 |
| Red Hat Advanced Cluster Security 4.9 1775594284 | earliest → < 1775594284 | 1775594284 |
| Red Hat Openshift Data Foundation 4.2 1783669219 | earliest → < 1783669219 | 1783669219 |
| Red Hat Openshift Data Foundation 4.18 1783677533 | earliest → < 1783677533 | 1783677533 |
| Red Hat Openshift Data Foundation 4.19 1783685375 | earliest → < 1783685375 | 1783685375 |
| Red Hat Satellite 6.18 1785922764 | earliest → < 1785922764 | 1785922764 |
References
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat Advanced Cluster Security for Kubernetes 4.8
The 22 CVEs of Red Hat Advanced Cluster Security for Kubernetes 4.8 →
CVE-2026-35469
spdystream is a Go library for multiplexing streams over SPDY connections
8.7
High
CVE-2026-33816
Memory-safety vulnerability in github.com/jackc/pgx/v5
9.8
Critical
CVE-2026-33815
Memory-safety vulnerability in github.com/jackc/pgx/v5
9.8
Critical
CVE-2026-34986
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including…
7.5
High