Security Advisory

CVE-2026-44664

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-05-13 15:27:34

Last updated 2026-05-13 16:46:25

Assigner GitHub_M

CVSS score 6.1

State PUBLISHED

Description

fast-xml-builder builds XML from JSON. In 1.1.5, the fix for CVE-2026-41650 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace(/--/g, '- -'). This skip the values containing three consecutive dashes (e.g., --->...), allowing an attacker to break out of an XML comment and inject arbitrary XML/HTML content. This vulnerability is fixed in 1.1.6.

← Browse all CVEs View on cve.org ↗