Skip to content
fr Sign in
6.1 Medium

CVE-2026-41650 fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks

Description

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the "-->" sequence in comment content or the "]]>" sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation. This issue has been patched in version 5.7.0.

Affected products and versions

Product Affected versions Fixed in
fast-xml-parser 5.7 earliest → < 5.7.0 5.7.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of fast-xml-parser

The 10 CVEs of fast-xml-parser →
CVE-2026-73569 fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks 8.7 High CVE-2026-33349 fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks 5.9 Medium CVE-2026-33036 fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks 7.5 High CVE-2026-27942 fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based… 2.7 Low
Track this CVE