PT-2026-34614

CVE-2026-41650

Published

2026-04-22

Updated

2026-11-02

Description by

CVSS 3.1

6.1

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions fast-xml-parser versions prior to 5.7.0

Description XMLBuilder fails to escape the "-->" sequence in comment content and the ">>" sequence in CDATA sections when generating XML from JavaScript objects. This flaw enables XML injection if user-controlled data is included in comments or CDATA elements, which can result in cross-site scripting (XSS), SOAP injection, or data manipulation.

Recommendations Update to version 5.7.0.

Exploitability

Exploit

Fix

Researchers

Tharvid

Vendors

Affected products

Weakness enumeration

CWE-91: XML Injection (aka Blind XPath Injection)

Related identifiers

CVE-2026-41650