Medium severity · published May 13, 2026
CVE-2026-44665
fast-xml-builder: Attribute values with unwanted quotes can bypass malicious or unwanted attributes
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
fast-xml-builder builds XML from JSON. Prior to 1.1.7, when an input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into multiple attributes. This gives the room for an attacker to insert unwanted attributes to the XML/HTML. This vulnerability is fixed in 1.1.7.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FA
fast-xml-builder · NaturalIntelligence
< 1.1.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-44665
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-44665
github.com
https://github.com/NaturalIntelligence/fast-xml-builder/security/advisories/GHSA-5wm8-gmm8-39j9
More from fast-xml-builder
6.1
CVE-2026-44664
fast-xml-builder: Comment Value bypass regex