Cross-Site Scripting Vulnerability in fast-xml-parser by Natural Intelligence
CVE-2026-25896
9.3CRITICAL
What is CVE-2026-25896?
The fast-xml-parser library, which facilitates XML validation and parsing without the need for native C/C++ libraries, contains a serious flaw in versions prior to 5.3.5. A malicious user can leverage a dot (.) in a DOCTYPE entity name, treated as a regex wildcard, to shadow built-in XML entities such as <, >, &, ", and '. This manipulation allows an attacker to bypass entity encoding, resulting in the potential for Cross-Site Scripting (XSS) when the manipulated XML output is rendered. The issue has been rectified in version 5.3.5.
Affected Version(s)
fast-xml-parser >= 5.0.0, < 5.3.5 < 5.0.0, 5.3.5
fast-xml-parser >= 4.1.3, < 4.5.4 < 4.1.3, 4.5.4