XML Injection Vulnerability in node-webfont Package - CVE-2026-41650
Summary
DEBIAN-CVE-2026-41650: fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Affects node-webfont versions 11.4.0+dfsg2+~cs35.7.26-10 – 11.4.0+dfsg2+~cs35.7.26-9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-webfont package is a tool that allows developers to generate web fonts from various font formats. It simplifies the process of integrating custom fonts into web applications. However, prior to version 5.7.0, it was found to be vulnerable to XML injection due to improper handling of XML comments and CDATA sections.
Vulnerability Detail
The vulnerability arises from the fast-xml-parser library used in node-webfont, which does not escape the "-->" sequence in comments or the "]]>" sequence in CDATA sections when constructing XML from JavaScript objects. This flaw allows attackers to inject malicious XML content, potentially leading to cross-site scripting (XSS), SOAP injection, or data manipulation. The issue has been patched in version 5.7.0 of the library.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If you cannot immediately update the package, consider sanitizing user input that may flow into XML comments or CDATA sections. This can be done by validating and escaping any user-controlled data before processing it with the node-webfont package.
Conclusion
The XML injection vulnerability in the node-webfont package (CVE-2026-41650) poses significant risks to applications that utilize this package. It is crucial to update to the patched version 5.7.0 to mitigate these risks. Additionally, consider implementing input sanitization as a temporary workaround until the update can be applied.
See every vulnerability recorded for node-webfont →
FAQ
CVE-2026-41650 is a vulnerability in the node-webfont package that allows XML injection due to improper handling of XML comments and CDATA sections.
Exploiting this vulnerability can lead to XSS attacks, SOAP injection, or data manipulation, compromising the security and integrity of your application.
All versions of node-webfont prior to 5.7.0 are affected by this vulnerability.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring installation.
The CVSS score for this vulnerability is 6.1, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-webfont.
