{"id":"CVE-2026-25896","title":"fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback","summary":"fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard…","severity":"critical","cvss":9.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N","cwe":["CWE-185","CWE-79"],"vendor":"naturalintelligence","product":"fast-xml-parser","affected":["fast-xml-parser >= 4.1.3, < 5.3.5"],"patched":["fast-xml-parser 5.3.5"],"published":"2026-02-20","updated":"2026-09-10","sourceUpdated":"2026-09-10T13:17:54.697","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-25896","references":[{"url":"https://github.com/NaturalIntelligence/fast-xml-parser/commit/943ef0eb1b2d3284e72dd74f44a042ee9f07026e","label":"security-advisories@github.com"},{"url":"https://github.com/NaturalIntelligence/fast-xml-parser/commit/ddcd0acf26ddd682cb0dc15a2bd6aa3b96bb1e69","label":"security-advisories@github.com"},{"url":"https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.5","label":"security-advisories@github.com"},{"url":"https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-m7jm-9gc2-mpf2","label":"security-advisories@github.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:40984","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41941","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:41944","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:51349","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:6174","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:6802","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:7110","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:7128","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-25896","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2441501","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25896.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25896"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25896"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat","score-dispute"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-02-23T19:26:46.154155Z"},"epss":0.0047,"epssPercentile":0.39869,"scores":{"nvd":9.3,"vendor":7.1,"cna":9.3},"ingestedAt":"2026-07-16T12:53:55.852Z","slug":"CVE-2026-25896","body":"## Overview\n\nfast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (&lt;, &gt;, &amp;, &quot;, &apos;) with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5.\n\n## Affected\n\n- `fast-xml-parser >= 4.1.3, < 5.3.5`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `fast-xml-parser 5.3.5`\n\n## Vendor advisories\n\n- **RHSA-2026:7110** · Red Hat · fixed in: Red Hat Advanced Cluster Security 4.8 · released 2026-04-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:7110)\n- **RHSA-2026:7128** · Red Hat · fixed in: Red Hat Advanced Cluster Security 4.9 · released 2026-04-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:7128)\n- **RHSA-2026:6174** · Red Hat · fixed in: Red Hat Developer Hub 1.8 · released 2026-03-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:6174)\n- **RHSA-2026:6802** · Red Hat · fixed in: Red Hat Developer Hub 1.9 · released 2026-04-07 · [advisory](https://access.redhat.com/errata/RHSA-2026:6802)\n- **RHSA-2026:41941** · Red Hat · fixed in: Red Hat Openshift Data Foundation 4.18 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:41941)\n- **RHSA-2026:41944** · Red Hat · fixed in: Red Hat Openshift Data Foundation 4.19 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:41944)\n- **RHSA-2026:40984** · Red Hat · fixed in: Red Hat Openshift Data Foundation 4.2 · released 2026-07-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:40984)\n- **RHSA-2026:51349** · Red Hat · fixed in: Red Hat Satellite 6.18 · released 2026-08-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:51349)\n- **Red Hat VEX** · Important · affected: Migration Toolkit for Applications 8, Red Hat OpenShift GitOps, Red Hat OpenShift Virtualization 4, Self-service automation portal 2 · no fix planned: Red Hat OpenShift GitOps, Migration Toolkit for Applications 8, Red Hat OpenShift Virtualization 4, Self-service automation portal 2 · updated 2026-09-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25896.json)","depth":"abyssal","depthScore":63,"depthScoreParts":{"impact":51.2,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":201482,"id":"CVE-2026-25896","ts":1789399493047,"field":"exploit_available","old":"false","new":"true"},{"seq":200216,"id":"CVE-2026-25896","ts":1789397057445,"field":"exploit_available","old":"true","new":"false"},{"seq":198140,"id":"CVE-2026-25896","ts":1789391726697,"field":"exploit_available","old":"false","new":"true"},{"seq":195933,"id":"CVE-2026-25896","ts":1789383380651,"field":"exploit_available","old":"true","new":"false"},{"seq":194862,"id":"CVE-2026-25896","ts":1789380297407,"field":"exploit_available","old":"false","new":"true"},{"seq":193649,"id":"CVE-2026-25896","ts":1789378245970,"field":"exploit_available","old":"true","new":"false"},{"seq":192436,"id":"CVE-2026-25896","ts":1789376217907,"field":"exploit_available","old":"false","new":"true"},{"seq":191223,"id":"CVE-2026-25896","ts":1789373106738,"field":"exploit_available","old":"true","new":"false"},{"seq":190008,"id":"CVE-2026-25896","ts":1789369118467,"field":"exploit_available","old":"false","new":"true"},{"seq":188795,"id":"CVE-2026-25896","ts":1789368033151,"field":"exploit_available","old":"true","new":"false"},{"seq":187578,"id":"CVE-2026-25896","ts":1789364987028,"field":"exploit_available","old":"false","new":"true"},{"seq":186365,"id":"CVE-2026-25896","ts":1789362976652,"field":"exploit_available","old":"true","new":"false"},{"seq":185151,"id":"CVE-2026-25896","ts":1789360958214,"field":"exploit_available","old":"false","new":"true"},{"seq":183938,"id":"CVE-2026-25896","ts":1789357918050,"field":"exploit_available","old":"true","new":"false"},{"seq":182190,"id":"CVE-2026-25896","ts":1789354081407,"field":"exploit_available","old":"false","new":"true"},{"seq":180983,"id":"CVE-2026-25896","ts":1789352931913,"field":"exploit_available","old":"true","new":"false"},{"seq":179776,"id":"CVE-2026-25896","ts":1789349983684,"field":"exploit_available","old":"false","new":"true"},{"seq":178569,"id":"CVE-2026-25896","ts":1789347781499,"field":"exploit_available","old":"true","new":"false"},{"seq":177362,"id":"CVE-2026-25896","ts":1789346169361,"field":"exploit_available","old":"false","new":"true"},{"seq":176155,"id":"CVE-2026-25896","ts":1789342723939,"field":"exploit_available","old":"true","new":"false"},{"seq":175939,"id":"CVE-2026-25896","ts":1789342332027,"field":"exploit_available","old":"false","new":"true"},{"seq":175479,"id":"CVE-2026-25896","ts":1789338372639,"field":"exploit_available","old":"true","new":"false"},{"seq":174274,"id":"CVE-2026-25896","ts":1789334588036,"field":"exploit_available","old":"false","new":"true"},{"seq":173069,"id":"CVE-2026-25896","ts":1789333195836,"field":"exploit_available","old":"true","new":"false"},{"seq":171883,"id":"CVE-2026-25896","ts":1789330875346,"field":"exploit_available","old":"false","new":"true"},{"seq":170697,"id":"CVE-2026-25896","ts":1789328376669,"field":"exploit_available","old":"true","new":"false"},{"seq":169492,"id":"CVE-2026-25896","ts":1789326898003,"field":"exploit_available","old":"false","new":"true"},{"seq":168287,"id":"CVE-2026-25896","ts":1789323417554,"field":"exploit_available","old":"true","new":"false"},{"seq":167082,"id":"CVE-2026-25896","ts":1789319359262,"field":"exploit_available","old":"false","new":"true"},{"seq":165877,"id":"CVE-2026-25896","ts":1789318256334,"field":"exploit_available","old":"true","new":"false"},{"seq":164672,"id":"CVE-2026-25896","ts":1789315529196,"field":"exploit_available","old":"false","new":"true"},{"seq":163467,"id":"CVE-2026-25896","ts":1789313244758,"field":"exploit_available","old":"true","new":"false"},{"seq":162262,"id":"CVE-2026-25896","ts":1789311709445,"field":"exploit_available","old":"false","new":"true"},{"seq":161057,"id":"CVE-2026-25896","ts":1789308248073,"field":"exploit_available","old":"true","new":"false"},{"seq":160562,"id":"CVE-2026-25896","ts":1789304188178,"field":"exploit_available","old":"false","new":"true"},{"seq":158400,"id":"CVE-2026-25896","ts":1789299260075,"field":"exploit_available","old":"true","new":"false"},{"seq":157364,"id":"CVE-2026-25896","ts":1789296456169,"field":"exploit_available","old":"false","new":"true"},{"seq":156159,"id":"CVE-2026-25896","ts":1789294362542,"field":"exploit_available","old":"true","new":"false"},{"seq":154954,"id":"CVE-2026-25896","ts":1789292630047,"field":"exploit_available","old":"false","new":"true"},{"seq":153749,"id":"CVE-2026-25896","ts":1789289334673,"field":"exploit_available","old":"true","new":"false"},{"seq":152961,"id":"CVE-2026-25896","ts":1789285237648,"field":"exploit_available","old":"false","new":"true"},{"seq":152205,"id":"CVE-2026-25896","ts":1789280952022,"field":"exploit_available","old":"true","new":"false"},{"seq":151166,"id":"CVE-2026-25896","ts":1789277448038,"field":"exploit_available","old":"false","new":"true"},{"seq":147895,"id":"CVE-2026-25896","ts":1789270868241,"field":"exploit_available","old":"true","new":"false"},{"seq":145935,"id":"CVE-2026-25896","ts":1789269172382,"field":"exploit_available","old":"false","new":"true"},{"seq":144838,"id":"CVE-2026-25896","ts":1789266102995,"field":"exploit_available","old":"true","new":"false"},{"seq":143742,"id":"CVE-2026-25896","ts":1789262438521,"field":"exploit_available","old":"false","new":"true"},{"seq":142578,"id":"CVE-2026-25896","ts":1789261176111,"field":"exploit_available","old":"true","new":"false"},{"seq":141414,"id":"CVE-2026-25896","ts":1789258608655,"field":"exploit_available","old":"false","new":"true"},{"seq":140216,"id":"CVE-2026-25896","ts":1789256389596,"field":"exploit_available","old":"true","new":"false"}]}