SB2026072008 - XML injection in fast-xml-builder

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026072008

SB2026072008 - XML injection in fast-xml-builder

Published: July 20, 2026

Security Bulletin ID SB2026072008
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) XML injection (CVE-ID: CVE-2026-44665)

CWE-ID: CWE-91 - XML Injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to insert unwanted attributes to the XML/HTML.

The vulnerability exists when an input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into multiple attributes and gives the room for an attacker to insert unwanted attributes to the XML/HTML. A remote unauthenticated attacker can trick the victim into opening a specially crafted XML data to the application and perform arbitrary actions on the system.


Remediation

Install update from vendor's website.

References