GHSA-5wm8-gmm8-39j9 CVE-2026-44665

fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes

High npm

Severity: 8.7 / 10; High · CVSS 4.0
Exploit chance (EPSS): 0.24%; Chance of exploitation in the next 30 days. Higher than 14.66% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-91 XML Injection (aka Blind XPath Injection); CWE-611 Improper Restriction of XML External Entity Reference
Fix: 1.1.7; Upgrade fast-xml-builder to this version or later

Description

Summary

When an input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into multiple attributes. This gives the room for an attacker to insert unwanted attributes to the XML/HTML.

Detail

Malicious Input

{
      a: {
        "@_attr": '" onClick="alert(1)'
      }
}

Output

<a attr="" onClick="alert(1)"></a>

Workarounds

If you're not ignoring attributes then keep processEntities flag true.

Affected versions

npm

Package	Vulnerable	Fixed in
fast-xml-builder	`<= 1.1.6`	No fix yet
fast-xml-builder	`< 1.1.7`	`1.1.7`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

fast-xml-builder npm → `1.1.7`

npm

npm install fast-xml-builder@1.1.7

yarn

yarn add fast-xml-builder@1.1.7

pnpm

pnpm add fast-xml-builder@1.1.7

Severity breakdown

CVSS 4.0 8.7

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: None
Confidentiality (vulnerable system): None
Integrity (vulnerable system): High
Availability (vulnerable system): None
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

CVSS 3.1 6.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: Required
Scope: Changed
Confidentiality: Low
Integrity: Low
Availability: None

Weakness

CWE-91: XML Injection (aka Blind XPath Injection)

The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.

How to prevent it

Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.

CWE-611: Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

How to prevent it

Implementation, System Configuration: Many XML parsers and validators can be configured to disable external entity expansion.

References

Advisories

Packages

github.com/NaturalIntelligence/fast-xml-builder

Timeline

May 8, 2026 Published
Oct 26, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-45c6-75p6-83cc fast-xml-builder Comment Value regex can be bypassed	Medium	Also affects fast-xml-builder
GHSA-vr34-hp96-76pp xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator	High	Same weakness, CWE-91
GHSA-jxjr-3g7g-3944 xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator	High	Same weakness, CWE-91
GHSA-c7q8-3ch8-vqpv xmldom: Processing Instruction Target Injection Bypasses requireWellFormed	High	Same weakness, CWE-91
GHSA-3px3-54cx-rmw9 xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path	High	Same weakness, CWE-91
GHSA-27p8-2357-5qqv xmldom: DocType `name` Injection Bypasses requireWellFormed	High	Same weakness, CWE-91
GHSA-w2rr-34g9-rvrj xmldom: Element name injection via createElement() bypasses requireWellFormed	High	Same weakness, CWE-91
GHSA-4w3w-2rp5-g8jm xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed	High	Same weakness, CWE-91

Credits: amitguptagwl

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor