CVE-2026-44665

fast-xml-builder builds XML from JSON. Prior to 1.1.7, when an input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into multiple attributes. This gives the room for an attacker to insert unwanted attributes to the XML/HTML. This vulnerability is fixed in 1.1.7.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/NaturalIntelligence/fast-xml-builder/security/advisories/GHSA-5wm8-gmm8-39j9
https://github.com/NaturalIntelligence/fast-xml-builder/security/advisories/GHSA-5wm8-gmm8-39j9

Configurations

No configuration.

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) fast-xml-builder construye XML a partir de JSON. Antes de 1.1.7, cuando un dato de entrada tiene comillas en los valores de los atributos pero el procesamiento de entidades no está habilitado, divide el valor del atributo en múltiples atributos. Esto da pie a que un atacante inserte atributos no deseados en el XML/HTML. Esta vulnerabilidad está corregida en 1.1.7.

Information

Published : 2026-05-13 16:16

Updated : 2026-10-26 18:10

NVD link : CVE-2026-44665

Mitre link : CVE-2026-44665

CVE.ORG link : CVE-2026-44665

JSON object : View

Products Affected

No product.

CWE

CWE-91

XML Injection (aka Blind XPath Injection)

{"id": "CVE-2026-44665", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44665", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-18T15:04:25.555974Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "NaturalIntelligence", "product": "fast-xml-builder", "versions": [{"status": "affected", "version": "< 1.1.7"}]}]}], "published": "2026-05-13T16:16:59.093", "references": [{"url": "https://github.com/NaturalIntelligence/fast-xml-builder/security/advisories/GHSA-5wm8-gmm8-39j9", "source": "security-advisories@github.com"}, {"url": "https://github.com/NaturalIntelligence/fast-xml-builder/security/advisories/GHSA-5wm8-gmm8-39j9", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-91"}]}], "descriptions": [{"lang": "en", "value": "fast-xml-builder builds XML from JSON. Prior to 1.1.7, when an input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into multiple attributes. This gives the room for an attacker to insert unwanted attributes to the XML/HTML. This vulnerability is fixed in 1.1.7."}, {"lang": "es", "value": "fast-xml-builder construye XML a partir de JSON. Antes de 1.1.7, cuando un dato de entrada tiene comillas en los valores de los atributos pero el procesamiento de entidades no est\u00e1 habilitado, divide el valor del atributo en m\u00faltiples atributos. Esto da pie a que un atacante inserte atributos no deseados en el XML/HTML. Esta vulnerabilidad est\u00e1 corregida en 1.1.7."}], "lastModified": "2026-10-26T18:10:00.173", "sourceIdentifier": "security-advisories@github.com"}