CVE-2026-41650: fast-xml-parser XMLBuilder Comment and CDATA Injection Vulnerability

Background

fast-xml-parser is a popular JavaScript library used for parsing and building XML from JavaScript objects. It provides features like XML validation, customizable options for XML generation, and support for comments and CDATA sections. However, it has a vulnerability in its XMLBuilder component that allows for XML injection through unescaped delimiters in comments and CDATA sections.

Vulnerability Detail

The vulnerability arises from the fact that fast-xml-parser's XMLBuilder does not escape the --> sequence in comments or the ]]> sequence in CDATA sections when generating XML. This oversight can lead to XML injection attacks, allowing an attacker to inject malicious scripts or modify the structure of SOAP messages and RSS feeds. The potential ramifications include Cross-Site Scripting (XSS), SOAP injection, and data manipulation, making it a serious concern for applications that utilize user-controlled data in XML comments or CDATA.

npm install fast-xml-parser@5.11.2

npm install fast-xml-parser@5.7.0

Workaround

If you cannot update the package immediately, you can implement a workaround by manually escaping the delimiters in your data before passing it to the XMLBuilder. For comments, replace '--' with '--'. For CDATA, split on ']]>' and rejoin with separate CDATA sections. Here is an example of how to do this:

const safeComment = userComment.replace(/--/g, '--');
const safeCdata = userCdata.replace(/]]>/g, ']]]]><![CDATA[>');

Conclusion

The fast-xml-parser library has a significant vulnerability (CVE-2026-41650) that allows for XML injection through unescaped delimiters in comments and CDATA sections. It is crucial to update to the patched version or implement workarounds to mitigate the risks associated with this vulnerability.

See every vulnerability recorded for fast-xml-parser →

FAQ