PT-2026-39287 · Npm · Fast-Xml-Builder

CVE-2026-44665 · Published 2026-05-08 · Updated 2026-06-09

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions fast-xml-builder versions prior to 1.1.7

Description When input data contains quotes in attribute values and the processEntities flag is disabled, the software incorrectly splits the attribute value into multiple attributes. This allows an attacker to inject unauthorized attributes into the resulting XML or HTML output.

Recommendations Update to version 1.1.7. Keep the processEntities flag set to true if attributes are not being ignored.

Exploit

Fix

XXE

Weakness Enumeration

CWE-91

CWE-611

Related Identifiers

CVE-2026-44665

GHSA-5WM8-GMM8-39J9

Affected Products

Fast-Xml-Builder

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44665.json · Exploit
• 🔥 https://github.com/NaturalIntelligence/fast-xml-builder/security/advisories/GHSA-5wm8-gmm8-39j9 · Exploit
• https://osv.dev/vulnerability/CVE-2026-44665 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44665 · Security Note
• https://osv.dev/vulnerability/GHSA-5wm8-gmm8-39j9 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-44665 · Vendor Advisory
• https://github.com/NaturalIntelligence/fast-xml-builder · Note
• https://t.me/CVEtracker/53672 · Telegram Post