Executive brief
fast-xml-builder is a JavaScript library that converts JSON objects into XML documents. A flaw in its comment-handling code allows attackers to inject malicious XML or JavaScript code when user-controlled data is included in XML comments. An application using this library to build XML from untrusted input could end up generating XML documents containing attacker-controlled tags or scripts, leading to code execution in browsers, SOAP injection attacks, or RSS feed poisoning.
Technical details
The vulnerability is an XML injection (CWE-91) resulting from incomplete input sanitization. fast-xml-builder attempts to escape double-dash sequences (--) in XML comments by replacing them with single dashes separated by a space (- -). However, this regex-based fix fails when the input contains three or more consecutive dashes (e.g., ---), because the replacement only handles pairs, leaving the third dash intact. An attacker can use this to inject sequences like ---><script>...<!-- to break out of the comment context and inject arbitrary XML/HTML. The vulnerability exists in comment building logic and requires the application to have comment property enabled, but needs no authentication. A fix is available in version 1.1.6, which properly escapes all dash sequences.
Affected products
- NaturalIntelligence fast-xml-builder 1.1.5
Timeline
- 2026-05-08: disclosed: Vulnerability published as GHSA-45c6-75p6-83cc
- 2026-05-08: patched: Fixed in version 1.1.6
- 2026-05-13: advisory: CVE-2026-44664 published via NVD