6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41650

CVE-2026-41650: fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the "-->" sequence in comment content or the "]]>" sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation. This issue has been patched in version 5.7.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41650

CVE-2026-41650:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
fast-xml-parser	npm	< 5.7.0	5.7.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, GHSA-gh4j-gqv2-49f6, exists in the XMLBuilder component of the fast-xml-parser library. The root cause is the improper handling of user-supplied data when creating XML comments and CDATA sections. The XMLBuilder.buildTextValNode function directly embeds content into  and <![CDATA[...]]> blocks without escaping the respective closing delimiters (--> and ]]>).

An attacker can exploit this by crafting input where a comment or CDATA value contains a closing delimiter followed by malicious XML. For example, a comment value of --> <injected/> <!-- would close the original comment and inject a new <injected/> element into the XML structure.

The vulnerability is triggered through the public XMLBuilder.build method, which processes the input object and calls buildTextValNode internally. Both functions would appear in a runtime profile during an exploit. The fix was implemented in the fast-xml-builder dependency (patched in v1.1.5) and then integrated into fast-xml-parser in version 5.7.0.

Vulnerable functions

XMLBuilder.buildTextValNode

src/fxb.js

This function is responsible for constructing XML comment and CDATA nodes. It is vulnerable because it directly concatenates user-provided values (`val`) into the XML string without escaping the comment delimiter (`-->`) or the CDATA delimiter (`]]>`). This allows an attacker who can control the content of a comment or CDATA section to break out of the intended context and inject arbitrary XML, leading to Cross-Site Scripting (XSS), SOAP injection, or other XML injection attacks.

XMLBuilder.build

src/fxb.js

This is the primary public method of the `XMLBuilder` class used to generate the final XML string from a JavaScript object. When the input object contains properties intended to be comments or CDATA sections, this method will delegate their creation to the vulnerable `buildTextValNode` function. Therefore, `XMLBuilder.build` would be the top-level function in the call stack that initiates the vulnerable operation and would appear in any runtime profile or stack trace during exploitation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.