CVE-2026-44665CWE-91

fast-xml-builder: Attribute values with unwanted quotes can bypass malicious or unwanted attributes

Medium · published May 13, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
15.9
In the wild
Unconfirmed
What it is

fast-xml-builder builds XML from JSON. Prior to 1.1.7, when an input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into multiple attributes. This gives the room for an attacker to insert unwanted attributes to the XML/HTML. This vulnerability is fixed in 1.1.7.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00253 · 15.9th percentile
Weakness
CWE-91 · XML Injection (aka Blind XPath Injection)
Published
2026-05-13T15:24Z
EPSS history
Timeline
  • 13 MAY 15:24Z
    fast-xml-builder: Attribute values with unwanted quotes can bypass malicious or unwanted attributes
    cvelistv5