Most recent entries from all

EUVD-2026-319278

fkie_cve-2026-44665

fast-xml-builder builds XML from JSON. Prior to 1.1.7, when an input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into multiple attributes. This gives the room for an attacker to insert unwanted attributes to the XML/HTML. This vulnerability is fixed in 1.1.7.

GHSA-5wm8-gmm8-39j9 — fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes

Affected: npm: fast-xml-builder

# Summary When an input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into multiple attributes. This gives the room for an attacker to insert unwanted attributes to the XML/HTML.

## Detail

Malicious Input ``` { a: { "@_attr": '" onClick="alert(1)' } } ```

Output ```xml <a attr="" onClick="alert(1)"></a> ```

### Workarounds If you're not ignoring attributes then keep processEntities flag true.

RHSA-2026:56928 — Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.22.2 security, enhancement & bug fix update

fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies fast-uri: fast-uri: URI authority bypass due to improper delimiter handling postcss-selector-parser: Postcss: Denial of Service via uncontrolled recursion in AST Serialization picomatch: Picomatch: Regular Expression Denial of Service via crafted extglob patterns picomatch: Picomatch: Data integrity compromised via method injection with crafted POSIX bracket expressions brace-expansion: brace-expansion: Denial of Service via zero step value in brace pattern react-router: React Router: Open redirect vulnerability via specially crafted URLs postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags fast-xml-parser: fast-xml-parser: XML injection via improper escaping of comment and CDATA sequences uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input fast-xml-builder: fast-xml-builder: Attribute injection leading to information disclosure or content manipulation brace-expansion: brace-expansion: Denial of Service due to excessive memory allocation when expanding large numeric ranges ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`