CVE-2026-41650CWE-91

fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters

Medium · published May 7, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
18.5
In the wild
Unconfirmed
What it is

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the "-->" sequence in comment content or the "]]>" sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation. This issue has been patched in version 5.7.0.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00271 · 18.5th percentile
Weakness
CWE-91 · XML Injection (aka Blind XPath Injection)
Published
2026-05-07T13:36Z
EPSS history
Timeline
  • 07 MAY 13:36Z
    fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters
    cvelistv5