PT-2026-39286 · Npm · Fast-Xml-Builder

Published 2026-05-08 · Updated 2026-05-13 · CVE-2026-44664

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions fast-xml-builder version 1.1.5

Description An issue exists where the sanitization of -- sequences in XML comment content is insufficient. The use of .replace(/--/g, '- -') fails to handle values containing three consecutive dashes (e.g., --->...), which allows an attacker to break out of an XML comment and inject arbitrary XML or HTML content, such as JavaScript script tags, into the output when the comment property is enabled.

Recommendations Update to version 1.1.6. As a temporary workaround, externally check for the presence of three consecutive dashes in the property value used for the comment tag.

Fix

Weakness Enumeration

CWE-91

Related Identifiers

CVE-2026-44664

GHSA-45C6-75P6-83CC

Affected Products

Fast-Xml-Builder

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-44664 · Security Note
• https://osv.dev/vulnerability/GHSA-45c6-75p6-83cc · Vendor Advisory
• https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-gh4j-gqv2-49f6 · Note
• https://github.com/NaturalIntelligence/fast-xml-builder · Note
• https://github.com/NaturalIntelligence/fast-xml-builder/security/advisories/GHSA-45c6-75p6-83cc · Note
• https://t.me/CVEtracker/53671 · Telegram Post