{"id":"EUVD-2026-30052","enisaUuid":"41e00e4c-cb14-3546-95c4-cb5843ab8a0d","description":"fast-xml-builder builds XML from JSON. In 1.1.5, the fix for CVE-2026-41650 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace(/--/g, \u0027- -\u0027). This skip the values containing three consecutive dashes (e.g., ---\u003e...), allowing an attacker to break out of an XML comment and inject arbitrary XML/HTML content. This vulnerability is fixed in 1.1.6.","datePublished":"May 13, 2026, 3:27:34 PM","dateUpdated":"May 13, 2026, 4:46:25 PM","baseScore":6.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/NaturalIntelligence/fast-xml-builder/security/advisories/GHSA-45c6-75p6-83cc\n","aliases":"CVE-2026-44664\nGHSA-45c6-75p6-83cc\n","assigner":"GitHub_M","epss":0.19,"enisaIdProduct":[{"id":"24a37b6a-53ad-356f-8cb5-e33bcb5b22c8","product":{"name":"fast-xml-builder","vendor":{"name":"NaturalIntelligence"}},"product_version":"1.1.5"}],"enisaIdVendor":[{"id":"720efbe9-7778-3fa1-86f0-aec83cb53afc","vendor":{"name":"NaturalIntelligence"}}],"enisaIdVulnerability":[{"id":"126b5add-96e1-3ec8-9a79-1b4e3d472e79","vulnerability":{"id":"GHSA-45c6-75p6-83cc","description":"fast-xml-builder Comment Value regex can be bypassed","datePublished":"May 8, 2026, 4:27:28 PM","dateUpdated":"May 14, 2026, 8:37:30 PM","baseScore":0.0,"references":"https://github.com/NaturalIntelligence/fast-xml-builder/security/advisories/GHSA-45c6-75p6-83cc\nhttps://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-gh4j-gqv2-49f6\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44664\nhttps://github.com/NaturalIntelligence/fast-xml-builder\n","enisa_id":"EUVD-2026-30052\n","aliases":"CVE-2026-44664\nGHSA-45c6-75p6-83cc\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"9f0318f9-e5e2-37af-9ba6-c0266ef4e8ea","vulnerability":{"id":"CVE-2026-44664","description":"fast-xml-builder builds XML from JSON. In 1.1.5, the fix for CVE-2026-41650 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace(/--/g, \u0027- -\u0027). This skip the values containing three consecutive dashes (e.g., ---\u003e...), allowing an attacker to break out of an XML comment and inject arbitrary XML/HTML content. This vulnerability is fixed in 1.1.6.","datePublished":"May 13, 2026, 3:27:34 PM","dateUpdated":"May 13, 2026, 4:46:25 PM","status":"PUBLISHED","baseScore":6.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/NaturalIntelligence/fast-xml-builder/security/advisories/GHSA-45c6-75p6-83cc\n","enisa_id":"EUVD-2026-30052\n","assigner":"GitHub_M","epss":0.19,"dataProcessed":"Nov 5, 2026, 7:18:12 AM","vulnerabilityProduct":[{"id":"31b7b059-bfa1-3de0-9df2-7b55d279270e","product":{"name":"fast-xml-builder","vendor":{"name":"NaturalIntelligence"}},"product_version":"1.1.5"}],"vulnerabilityVendor":[{"id":"0bb7100b-ab39-37e9-b1a7-6ebd65c01ec0","vendor":{"name":"NaturalIntelligence"}}]}}],"enisaIdAdvisory":[]}