medium6.1
CVE-2026-44664
fast-xml-builder Comment Value regex can be bypassed
Impact
fast-xml-builder builds XML from JSON. In 1.1.5, the fix for CVE-2026-41650 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace(/--/g, '- -'). This skip the values containing three consecutive dashes (e.g., --->...), allowing an attacker to break out of an XML comment and inject arbitrary XML/HTML content. This vulnerability is fixed in 1.1.6.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | fast-xml-builder | = 1.1.5 | 1.1.6 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-45c6-75p6-83cc
- https://github.com/NaturalIntelligence/fast-xml-builder/security/advisories/GHSA-45c6-75p6-83cc
- https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-gh4j-gqv2-49f6
- https://nvd.nist.gov/vuln/detail/CVE-2026-44664