CVE-2026-44664 — fast-xml-builder: Comment Value bypass regex

CVE-2026-44664

fast-xml-builder: Comment Value bypass regex PUBLISHED

Description (CNA)

fast-xml-builder builds XML from JSON. In 1.1.5, the fix for CVE-2026-41650 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace(/--/g, '- -'). This skip the values containing three consecutive dashes (e.g., --->...), allowing an attacker to break out of an XML comment and inject arbitrary XML/HTML content. This vulnerability is fixed in 1.1.6.

Affected (CNA)

Vendor / product	Versions
NaturalIntelligence / fast-xml-builder	affected 1.1.5

CWE

CWE-91

References

https://github.com/NaturalIntelligence/fast-xml-builder/security/advisories/GHSA-45c6-75p6-83cc

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.