Junglewise Threat Intelligence

CVE-2026-25896: NaturalIntelligence fast-xml-parser XSS via regex injection in DOCTYPE

CVE-2026-25896 · Severity: critical · CVSS 9.3 · Published 2026-02-20

Executive brief

A vulnerability in the fast-xml-parser library allows attackers to bypass security protections that normally prevent malicious code from being injected into web pages. By sending a specially crafted XML file, an attacker can trick the software into ignoring standard safety filters, potentially leading to unauthorized data access or the execution of malicious scripts in a user's browser. This affects any application using this library to process untrusted data, including several enterprise platforms from Red Hat.

Technical details

A regex injection vulnerability exists in fast-xml-parser (v4 and v6 codebases) where a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement. Because DOCTYPE entities are processed before built-in XML entities (like < or &), an attacker can define an entity name such as 'l.' which generates the regex /&l.;/g. This matches and replaces standard entities like < with arbitrary, malicious values. This bypasses the library's entity encoding trust boundary, leading to Cross-Site Scripting (XSS) when the parsed output is rendered in HTML or potential SQL injection if used in database queries. The issue is fixed in version 5.3.5 by properly escaping regex metacharacters.

Affected products

  • NaturalIntelligence fast-xml-parser >= 4.1.3, < 5.3.5
  • Red Hat Red Hat Developer Hub 1.8, 1.9
  • Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.8, 4.9

Timeline

  • 2026-02-08: patched: Version 5.3.5 released
  • 2026-02-20: disclosed: Security advisory published via GitHub and NVD
  • 2026-03-30: advisory: Red Hat issued security advisory RHSA-2026:6174

References

Related threats