Medium severity6.1GHSA Advisory· Published May 13, 2026· Updated May 13, 2026
CVE-2026-44664
CVE-2026-44664
Description
fast-xml-builder builds XML from JSON. In 1.1.5, the fix for CVE-2026-41650 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace(/--/g, '- -'). This skip the values containing three consecutive dashes (e.g., --->...), allowing an attacker to break out of an XML comment and inject arbitrary XML/HTML content. This vulnerability is fixed in 1.1.6.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
fast-xml-buildernpm | >= 1.1.5, < 1.1.6 | 1.1.6 |
Affected products
16- Range: = 1.1.5
- osv-coords15 versionspkg:apk/chainguard/dbgatepkg:apk/chainguard/dbgate-fipspkg:apk/chainguard/kibana-8.17pkg:apk/chainguard/kibana-8.17-bitnamipkg:apk/chainguard/kibana-8.17-iamguardedpkg:apk/chainguard/kibana-9.0pkg:apk/chainguard/kibana-9.0-bitnamipkg:apk/chainguard/kibana-9.0-iamguardedpkg:apk/chainguard/kibana-9.1pkg:apk/chainguard/kibana-9.1-iamguardedpkg:apk/chainguard/kibana-9.4pkg:apk/chainguard/kibana-9.4-iamguardedpkg:apk/chainguard/renovatepkg:apk/wolfi/renovatepkg:npm/fast-xml-builder
< 7.1.10-r0+ 14 more
- (no CPE)range: < 7.1.10-r0
- (no CPE)range: < 7.1.10-r0
- (no CPE)range: < 8.17.10-r20
- (no CPE)range: < 8.17.10-r20
- (no CPE)range: < 8.17.10-r20
- (no CPE)range: < 9.0.8-r22
- (no CPE)range: < 9.0.8-r22
- (no CPE)range: < 9.0.8-r22
- (no CPE)range: < 9.1.10-r15
- (no CPE)range: < 9.1.10-r15
- (no CPE)range: < 9.4.2-r1
- (no CPE)range: < 9.4.2-r1
- (no CPE)range: < 43.170.14-r0
- (no CPE)range: < 43.170.14-r0
- (no CPE)range: >= 1.1.5, < 1.1.6
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.