9.3
Critique
CVE-2026-25896 fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based…
Description
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat Advanced Cluster Security for Kubernetes 4.8 1775594119 | premières → < 1775594119 | 1775594119 |
| Red Hat Advanced Cluster Security for Kubernetes 4.9 1775594284 | premières → < 1775594284 | 1775594284 |
| Red Hat Developer Hub 1.8 1774545605 | premières → < 1774545605 | 1774545605 |
| Red Hat Developer Hub 1.9 1775140647 | premières → < 1775140647 | 1775140647 |
| Migration Toolkit for Applications 8 | Versions non publiées | |
| Red Hat Openshift Data Foundation 4 | Versions non publiées | |
| Red Hat OpenShift GitOps | Versions non publiées | |
| Red Hat OpenShift Virtualization 4 | Versions non publiées | |
| Red Hat Satellite 6 | Versions non publiées |
Afficher les 10 autres branches Masquer les 10 autres branches
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Self-service automation portal 2 | Versions non publiées | |
| fast-xml-parser 5.0 | 5.0.0 → < 5.3.5 | 5.3.5 |
| fast-xml-parser 4.1 | 4.1.3 → < 4.5.4 | 4.5.4 |
| Red Hat Openshift Data Foundation 4.20 1783669219 | premières → < 1783669219 | 1783669219 |
| Red Hat Advanced Cluster Security 4.8 1775594119 | premières → < 1775594119 | 1775594119 |
| Red Hat Advanced Cluster Security 4.9 1775594284 | premières → < 1775594284 | 1775594284 |
| Red Hat Openshift Data Foundation 4.2 1783669219 | premières → < 1783669219 | 1783669219 |
| Red Hat Openshift Data Foundation 4.18 1783677533 | premières → < 1783677533 | 1783677533 |
| Red Hat Openshift Data Foundation 4.19 1783685375 | premières → < 1783685375 | 1783685375 |
| Red Hat Satellite 6.18 1785922764 | premières → < 1785922764 | 1785922764 |
Références
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat Advanced Cluster Security for Kubernetes 4.8
Les 22 CVE de Red Hat Advanced Cluster Security for Kubernetes 4.8 →
CVE-2026-35469
spdystream is a Go library for multiplexing streams over SPDY connections
8.7
Élevée
CVE-2026-33816
Memory-safety vulnerability in github.com/jackc/pgx/v5
9.8
Critique
CVE-2026-33815
Memory-safety vulnerability in github.com/jackc/pgx/v5
9.8
Critique
CVE-2026-34986
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including…
7.5
Élevée