PT-2026-39287 · Npm · Fast-Xml-Builder

Published 2026-05-08 · Updated 2026-05-13 · CVE-2026-44665

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions fast-xml-builder versions prior to 1.1.7

Description When input data contains quotes in attribute values and the processEntities flag is disabled, the software incorrectly splits the attribute value into multiple attributes. This allows an attacker to inject unauthorized attributes into the resulting XML or HTML output.

Recommendations Update to version 1.1.7. Keep the processEntities flag set to true if attributes are not being ignored.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

CWE-91

Related Identifiers

CVE-2026-44665

GHSA-5WM8-GMM8-39J9

Affected Products

Fast-Xml-Builder

References · 6

• 🔥 https://github.com/NaturalIntelligence/fast-xml-builder/security/advisories/GHSA-5wm8-gmm8-39j9 · Exploit
• https://osv.dev/vulnerability/GHSA-5wm8-gmm8-39j9 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-44665 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44665 · Security Note
• https://github.com/NaturalIntelligence/fast-xml-builder · Note
• https://t.me/CVEtracker/53672 · Telegram Post