XML injection in fast-xml-builder - CVE-2026-44665
Published: July 20, 2026
Vulnerability identifier: #VU138390
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-44665
CWE-ID: CWE-91
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to insert unwanted attributes to the XML/HTML.
The vulnerability exists when an input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into multiple attributes and gives the room for an attacker to insert unwanted attributes to the XML/HTML. A remote unauthenticated attacker can trick the victim into opening a specially crafted XML data to the application and perform arbitrary actions on the system.
Affected software
fast-xml-builder
Storage Fusion Data Foundation
Storage Fusion Data Foundation
How to mitigate CVE-2026-44665
Install updates from vendor's website.
fast-xml-builder - update to 1.1.7
Storage Fusion Data Foundation - update to 4.22
Storage Fusion Data Foundation - update to 4.22