CVE-2026-44665: medium-severity vulnerability in NaturalIntelligence fast-xml-builder
fast-xml-builder: Attribute values with unwanted quotes can bypass malicious or unwanted attributes
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.1epss 0.2%
fast-xml-builder builds XML from JSON. Prior to 1.1.7, when an input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into multiple attributes. This gives the room for an attacker to insert unwanted attributes to the XML/HTML. This vulnerability is fixed in 1.1.7.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
NaturalIntelligence · fast-xml-builderRelated CVEs — NaturalIntelligence fast-xml-builder
In the same product, most dangerous first.