CVE-2026-44665

What it actually does

The flaw is an input-validation issue in fast-xml-builder versions prior to 1.1.7. When JSON data is converted into XML or HTML and an attribute value contains quote characters while entity processing is disabled, the serializer can incorrectly terminate the original attribute and interpret attacker-controlled text as additional attributes. This can allow attribute injection into generated XML/HTML. Depending on where the generated markup is consumed, the impact can include malformed XML, altered document semantics, injection of unintended HTML attributes, or client-side script/event-handler injection in downstream renderers. The CVSS scope change reflects that exploitation can affect a consuming component outside the vulnerable library itself, but exploitation generally requires the generated output to be viewed or processed by a user or downstream system.

Why it matters to the business

Applications that build XML or HTML from untrusted JSON using affected fast-xml-builder versions may produce documents that contain attacker-supplied attributes. In business terms, this can lead to tampered generated content, incorrect downstream processing, or user-facing injection issues such as malicious links or browser-executed behaviors if the output is rendered as HTML. The current public exploitation signal is low: EPSS is 0.00209, it is not listed in CISA KEV, it is not associated with ransomware campaigns, and no mature public exploit is indicated. However, because this is a reusable library, exposure may exist indirectly through application dependencies and should be addressed during normal dependency remediation cycles, with higher urgency for internet-facing applications that render generated markup to users.

How an attack unfolds

An attacker first identifies an application feature that accepts or stores JSON data later converted to XML or HTML by a vulnerable fast-xml-builder version. They submit crafted input containing quote characters inside a value that becomes an XML/HTML attribute. Because affected versions mishandle quotes in attribute values when entity processing is disabled, the generated markup can split the intended single attribute into multiple attributes. The attacker uses this parsing confusion to add attributes of their choice, such as event-handler attributes, URL attributes, style-related attributes, or application-specific metadata attributes. If the resulting XML is consumed by another parser, business logic may treat the injected attributes as legitimate. If the output is rendered as HTML and a user interacts with or views it in a vulnerable context, the injected attributes may trigger client-side behavior or alter what the user sees. Successful exploitation depends heavily on whether untrusted data reaches attribute values and how the generated output is consumed.

How to fix it

Upgrade fast-xml-builder to version 1.1.7 or later wherever it is used directly or transitively. Rebuild and redeploy applications after updating lockfiles and container images so the fixed library is actually present at runtime. If immediate upgrade is not possible, prevent untrusted input from being serialized into XML/HTML attributes, reject or encode quote characters in attribute values before serialization, enable safe entity/attribute escaping where applicable, and avoid rendering generated XML/HTML as trusted markup. Treat generated markup from user-controlled data as untrusted and apply output encoding or sanitization at the final rendering boundary. Review dependency manifests and lockfiles across npm-based projects for affected versions, including transitive copies bundled by upstream packages.

How to confirm the fix worked

Confirm that dependency manifests and lockfiles resolve fast-xml-builder to 1.1.7 or later, then verify deployed artifacts rather than only source repositories. Use package managers and software composition analysis tools to identify direct and transitive copies. For npm projects, inspect package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml, and node_modules metadata. Run a regression test that serializes JSON containing quote characters inside attribute values and confirm the output preserves the value safely rather than creating additional attributes. Also test the application’s final rendering or downstream parsing path to ensure generated XML/HTML is handled as untrusted data when it includes user-originated content.

Typical attack path

1. Identify an application endpoint, import workflow, API, or stored-content feature that accepts attacker-controlled JSON.
2. Determine or infer that submitted JSON is transformed into XML or HTML using a vulnerable fast-xml-builder version before being rendered, exported, emailed, or processed.
3. Craft an attribute value containing quote characters followed by additional attacker-controlled attribute syntax.
4. Submit the crafted JSON payload to the application or store it in a location that will later be serialized.
5. Trigger generation of the XML/HTML output or wait for a victim user or downstream system to process it.
6. Leverage the injected attributes to alter document behavior, influence downstream parsing, or cause client-side execution if the output is rendered as HTML in an exploitable context.

How to detect it

To determine whether exploitation already occurred, focus on application-layer evidence because exploitation occurs through crafted data passed into serialization, not through a distinctive network protocol. Review web/API access logs, request bodies where retained, WAF events, application audit logs, message queues, import files, and stored user-generated content for attribute-like payloads embedded inside values that should be plain text. Look for quote characters followed by new XML/HTML attributes, especially browser event-handler attributes, javascript: URLs, style manipulation, src/href injection, or application-specific privilege/status attributes. Review generated XML/HTML artifacts, exports, cached pages, emails, reports, or downstream integration payloads for unexpected attributes that do not correspond to application templates. If the output was rendered in browsers, correlate suspicious submissions with client-side error reports, content security policy violations, unusual redirects, unexpected script execution reports, or helpdesk reports of altered pages. For package exposure detection, inspect dependency and lockfiles for fast-xml-builder versions below 1.1.7, but note that vulnerable-version presence alone does not prove exploitation.

• fast-xml-builder@1.0.
• fast-xml-builder@1.1.0
• fast-xml-builder@1.1.1
• fast-xml-builder@1.1.2
• fast-xml-builder@1.1.3
• fast-xml-builder@1.1.4
• fast-xml-builder@1.1.5
• fast-xml-builder@1.1.6
• node_modules/fast-xml-builder/package.json
• "fast-xml-builder": "1.0.
• "fast-xml-builder": "1.1.0"
• "fast-xml-builder": "1.1.1"
• "fast-xml-builder": "1.1.2"
• "fast-xml-builder": "1.1.3"
• "fast-xml-builder": "1.1.4"
• "fast-xml-builder": "1.1.5"
• "fast-xml-builder": "1.1.6"
• onerror=
• onload=
• onclick=
• onmouseover=
• onfocus=
• autofocus onfocus=
• javascript:
• " onerror="
• " onload="
• " onclick="
• " onmouseover="
• " autofocus onfocus="

What your security team should do

• Inventory applications and services that use fast-xml-builder, prioritizing internet-facing systems and workflows that convert user-supplied JSON into XML or HTML.
• Upgrade affected usage to fast-xml-builder 1.1.7 or later and redeploy all affected runtime artifacts, including containers and serverless packages.
• Search dependency lockfiles and software composition analysis results for fast-xml-builder versions below 1.1.7, including transitive dependencies.
• Add regression tests for XML/HTML attribute serialization using embedded quotes and common attribute-injection payloads.
• Review generated XML/HTML rendering paths and ensure user-controlled output is encoded, sanitized, or treated as untrusted.
• Monitor application logs for suspicious submitted values containing quote-terminated attributes, event-handler attributes, or javascript: URLs in fields that are later serialized.
• Because EPSS is low and the vulnerability is not in KEV, remediate through standard dependency patching unless the application renders attacker-controlled generated HTML to users, in which case prioritize more aggressively.