CVE-2026-25896
EUVD-2026-752920.02.2026, 21:19
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| naturalintelligence | fast-xml-parser | 4.1.3 ≤ 𝑥 < 5.3.5 |
𝑥
= Vulnerable software versions
Debian Releases
Common Weakness Enumeration
- CWE-185 - Incorrect Regular ExpressionThe software specifies a regular expression in a way that causes data to be improperly matched or compared.
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
References