CVE-2026-41650 MEDIUM

CVE-2026-41650: fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters

Vendor Naturalintelligence
Product fast-xml-parser
Weakness CWE-91 · XML injection
Published May 7, 2026
Last update May 7, 2026
View on NVD All CVEs

CVSS base score

6.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the "-->" sequence in comment content or the "]]>" sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation. This issue has been patched in version 5.7.0.

Key dates

02Disclosure timeline

May 7, 2026 CVE published
May 7, 2026 Record updated