Executive brief
fast-xml-builder is a JavaScript library that converts JSON to XML. When processing attribute values containing quotes without entity processing enabled, the library incorrectly breaks the attribute into multiple attributes, allowing attackers to inject malicious XML attributes such as event handlers. This could enable XSS (cross-site scripting) attacks if the generated XML/HTML is rendered in a browser.
Technical details
The vulnerability is an XML/HTML attribute injection caused by improper handling of quote characters in attribute values when the processEntities flag is disabled. When an attacker-controlled attribute value contains a double quote followed by malicious attribute syntax (e.g., `" onClick="alert(1)`), the parser incorrectly splits the attribute, inserting the malicious payload as a separate attribute in the output XML/HTML. The root cause is a lack of proper quote escaping or validation. An attacker must be able to control the input JSON data passed to the library. The fix is available in version 1.1.7; affected versions are 1.1.6 and earlier. As a temporary workaround, users can enable the processEntities flag if not ignoring attributes.
Affected products
- NaturalIntelligence fast-xml-builder <1.1.7
Timeline
- 2026-05-08: disclosed: Vulnerability published in GitHub advisory database
- 2026-05-08: patched: Fix released in version 1.1.7