GHSA-gh4j-gqv2-49f6
Medium · 6.1CVSS
6.1
EPSS
—
Published
Apr 22, 2026
CISA due date
—
The record
fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | fast-xml-parser | 0 | 5.7.0 |
Related vulnerabilities
- CVE-2026-41650 fast-xml-parser allows users to process XML from JS object without C/C++ based libraries… Same vulnerability
- CVE-2026-33349 fast-xml-parser allows users to process XML from JS object without C/C++ based libraries… Also affects fast-xml-parser
- CVE-2026-33036 fast-xml-parser allows users to process XML from JS object without C/C++ based libraries… Also affects fast-xml-parser
- GHSA-jp2q-39xq-3w4g Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in… Also affects fast-xml-parser
- GHSA-8gc5-j5rx-235r fast-xml-parser affected by numeric entity expansion bypassing all entity expansion… Also affects fast-xml-parser
- GHSA-fj3w-jwp8-x2g3 fast-xml-parser has stack overflow in XMLBuilder with preserveOrder Also affects fast-xml-parser
- CVE-2026-27942 fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from… Also affects fast-xml-parser
- CVE-2026-25896 fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from… Also affects fast-xml-parser