Executive brief
A vulnerability in the fast-xml-parser library, which is used to convert JavaScript objects into XML, allows attackers to inject malicious code into generated XML documents. By including specific character sequences in data that the application then places into XML comments or CDATA sections, an attacker can break out of those sections to insert unauthorized commands or scripts. This can lead to cross-site scripting (XSS) in web browsers, the manipulation of SOAP web service messages, or the corruption of RSS feeds.
Technical details
The XMLBuilder component in fast-xml-parser fails to escape the '-->' sequence in comments and the ']]>' sequence in CDATA sections. When user-controlled data is passed to the builder via the commentPropName or cdataPropName properties, an attacker can provide input that terminates the intended XML section and injects arbitrary XML tags. This vulnerability, classified as CWE-91 (XML Injection), can be exploited to achieve Cross-Site Scripting (XSS) in SVG/HTML contexts, SOAP message injection, or general data manipulation. The issue is present in the buildTextValNode function within src/fxb.js and has been patched in version 5.7.0 by implementing proper delimiter escaping.
Affected products
- NaturalIntelligence fast-xml-parser < 5.7.0
Timeline
- 2026-04-18: advisory: GitHub Security Advisory GHSA-gh4j-gqv2-49f6 published
- 2026-05-07: disclosed: CVE-2026-41650 published to NVD
- 2026-05-07: patched: Issue fixed in version 5.7.0