CVE-2026-44665
fast-xml-builder: Attribute values with unwanted quotes can bypass malicious or unwanted attributes
- State
- Published
- Severity
- 6.1 Medium
- Published
- May 13, 2026
- Updated
- May 18, 2026
- Reserved
- May 7, 2026
Description
fast-xml-builder builds XML from JSON. Prior to 1.1.7, when an input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into multiple attributes. This gives the room for an attacker to insert unwanted attributes to the XML/HTML. This vulnerability is fixed in 1.1.7.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.1 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | GitHub_M |
Weaknesses
- CWE-91 XML Injection (aka Blind XPath Injection)
Affected Products
| Product | Versions |
|---|---|
fast-xml-builderNaturalIntelligence |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.