GHSA-45c6-75p6-83cc CVE-2026-44664
fast-xml-builder Comment Value regex can be bypassed
- Severity
- 6.1 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.19%
- Chance of exploitation in the next 30 days. Higher than 9.11% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-91 XML Injection (aka Blind XPath Injection)
- Fix
1.1.6- Upgrade fast-xml-builder to this version or later
Description
Summary
The fix for https://github.com/advisories/GHSA-gh4j-gqv2-49f6 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace(/--/g, '- -'). This skip the values containing three consecutive dashes (e.g., --->...), allowing an attacker to break out of an XML comment and inject arbitrary XML/HTML content.
Impact
Any application with comment property enabled allow attacker to inject malicious or unwanted code like JS script tag in the XML/HTML output.
Workarounds
Check for the presence of 3 consecutive dashes externally in the property value used for comment tag.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| fast-xml-builder | 1 listed versions | No fix yet |
| fast-xml-builder | >= 1.1.5, < 1.1.6 |
1.1.6 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
fast-xml-builder npm → 1.1.6
- npm
npm install fast-xml-builder@1.1.6- yarn
yarn add fast-xml-builder@1.1.6- pnpm
pnpm add fast-xml-builder@1.1.6
Severity breakdown
CVSS 3.1 6.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Changed
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Weakness
CWE-91: XML Injection (aka Blind XPath Injection)
The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
How to prevent it
- Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
References
Advisories
Packages
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-5wm8-gmm8-39j9 fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes | High | Also affects fast-xml-builder |
| GHSA-vr34-hp96-76pp xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator | High | Same weakness, CWE-91 |
| GHSA-jxjr-3g7g-3944 xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator | High | Same weakness, CWE-91 |
| GHSA-c7q8-3ch8-vqpv xmldom: Processing Instruction Target Injection Bypasses requireWellFormed | High | Same weakness, CWE-91 |
| GHSA-3px3-54cx-rmw9 xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path | High | Same weakness, CWE-91 |
| GHSA-27p8-2357-5qqv xmldom: DocType `name` Injection Bypasses requireWellFormed | High | Same weakness, CWE-91 |
| GHSA-w2rr-34g9-rvrj xmldom: Element name injection via createElement() bypasses requireWellFormed | High | Same weakness, CWE-91 |
| GHSA-4w3w-2rp5-g8jm xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed | High | Same weakness, CWE-91 |
Credits: amitguptagwl
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor