Is CVE-2026-41650 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41650 being exploited in the wild.

How severe is CVE-2026-41650?

Medium severity, with a CVSS score of 6.1, published 7 May 2026.

Which products and versions are affected?

fast-xml-parser (npm) SEMVER:introduced=0,fixed=5.7.0.

Is there a fix for CVE-2026-41650?

Yes. fast-xml-parser (npm): upgrade to 5.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41650 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-41650?

Check whether you run fast-xml-parser (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41650: NaturalIntelligence fast-xml-parser XML injection in XMLBuilder

CVE-2026-41650 · Severity: medium · CVSS 6.1 · Published 2026-05-07

A vulnerability in the fast-xml-parser library, which is used to convert JavaScript objects into XML, allows attackers to inject malicious code into generated XML documents. By including specific character sequences in data that the application then places into XML comments or CDATA sections, an attacker can break out of those sections to insert unauthorized commands or scripts. This can lead to cross-site scripting (XSS) in web browsers, the manipulation of SOAP web service messages, or the corruption of RSS feeds.

Technologies: fast-xml-parser (npm). Vendors: npm.

Quick answers

Is CVE-2026-41650 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41650 being exploited in the wild.
How severe is CVE-2026-41650?: Medium severity, with a CVSS score of 6.1, published 7 May 2026.
Which products and versions are affected?: fast-xml-parser (npm) SEMVER:introduced=0,fixed=5.7.0.
Is there a fix for CVE-2026-41650?: Yes. fast-xml-parser (npm): upgrade to 5.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41650 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-41650?: Check whether you run fast-xml-parser (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

fast-xml-parser (npm): upgrade to 5.7.0 or later
```
npm install fast-xml-parser@5.7.0
```

Technical details

The XMLBuilder component in fast-xml-parser fails to escape the '-->' sequence in comments and the ']]>' sequence in CDATA sections. When user-controlled data is passed to the builder via the commentPropName or cdataPropName properties, an attacker can provide input that terminates the intended XML section and injects arbitrary XML tags. This vulnerability, classified as CWE-91 (XML Injection), can be exploited to achieve Cross-Site Scripting (XSS) in SVG/HTML contexts, SOAP message injection, or general data manipulation. The issue is present in the buildTextValNode function within src/fxb.js and has been patched in version 5.7.0 by implementing proper delimiter escaping.

Affected products

NaturalIntelligence fast-xml-parser < 5.7.0

Identifiers

CVE-2026-41650
GHSA-gh4j-gqv2-49f6

Timeline

2026-04-18: advisory: GitHub Security Advisory GHSA-gh4j-gqv2-49f6 published
2026-05-07: disclosed: CVE-2026-41650 published to NVD
2026-05-07: patched: Issue fixed in version 5.7.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.