{"id":"GHSA-45c6-75p6-83cc","revision":"837d2b4de7a04f2d842fa7b91f5ed8b1","records":[{"revision":"837d2b4de7a04f2d842fa7b91f5ed8b1","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-45c6-75p6-83cc","aliases":["CVE-2026-44664"],"title":"fast-xml-builder Comment Value regex can be bypassed","description":"# Summary\nThe fix for https://github.com/advisories/GHSA-gh4j-gqv2-49f6 in fast-xml-parser sanitizes `--` sequences in XML comment content using .replace(/--/g, '- -'). This skip the values containing three consecutive dashes (e.g., --->...), allowing an attacker to break out of an XML comment and inject arbitrary XML/HTML content.\n\n### Impact\nAny application with comment property enabled allow attacker to inject malicious or unwanted code like JS script tag in the XML/HTML output.\n\n### Workarounds\nCheck for the presence of 3 consecutive dashes externally in the property value used for comment tag.","state":0,"publishedAt":"2026-05-08T16:27:28+00:00","modifiedAt":"2026-09-10T03:51:04.5845203+00:00","affected":[{"ecosystem":"npm","name":"fast-xml-builder","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.1.5"},{"kind":"fixed","version":"1.1.6"}]}],"versions":["1.1.5"],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/NaturalIntelligence/fast-xml-builder/security/advisories/GHSA-45c6-75p6-83cc","https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-gh4j-gqv2-49f6","https://nvd.nist.gov/vuln/detail/CVE-2026-44664","https://github.com/NaturalIntelligence/fast-xml-builder"],"sourceUrl":"https://github.com/advisories/GHSA-45c6-75p6-83cc","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-45c6-75p6-83cc","identifiers":["GHSA-45c6-75p6-83cc","CVE-2026-44664"]},"retained":false,"historicalAffected":[]}],"coverage":[]}