CVE-2026-25896

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-25896
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5.

9.3 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/NaturalIntelligence/fast-xml-parser/commit/943ef0eb1b2d3284e72dd74f44a042ee9f07026e Patch
https://github.com/NaturalIntelligence/fast-xml-parser/commit/ddcd0acf26ddd682cb0dc15a2bd6aa3b96bb1e69 Patch
https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.5 Product Release Notes
https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-m7jm-9gc2-mpf2 Exploit Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:*
History

02 Mar 2026, 14:54

Type Values Removed Values Added
References () https://github.com/NaturalIntelligence/fast-xml-parser/commit/943ef0eb1b2d3284e72dd74f44a042ee9f07026e - () https://github.com/NaturalIntelligence/fast-xml-parser/commit/943ef0eb1b2d3284e72dd74f44a042ee9f07026e - Patch
References () https://github.com/NaturalIntelligence/fast-xml-parser/commit/ddcd0acf26ddd682cb0dc15a2bd6aa3b96bb1e69 - () https://github.com/NaturalIntelligence/fast-xml-parser/commit/ddcd0acf26ddd682cb0dc15a2bd6aa3b96bb1e69 - Patch
References () https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.5 - () https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.5 - Product, Release Notes
References () https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-m7jm-9gc2-mpf2 - () https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-m7jm-9gc2-mpf2 - Exploit, Mitigation, Vendor Advisory
CPE cpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:*
Summary
  • (es) fast-xml-parser permite a los usuarios validar XML, analizar XML a objeto JS, o construir XML desde objeto JS sin librerías basadas en C/C++ y sin callback. Desde la versión 4.1.3 hasta antes de la 5.3.5, un punto (.) en un nombre de entidad DOCTYPE es tratado como un comodín de expresión regular durante el reemplazo de entidades, permitiendo a un atacante sombrear entidades XML incorporadas (<, >, &, ", ') con valores arbitrarios. Esto omite la codificación de entidades y conduce a XSS cuando la salida analizada es renderizada. Esta vulnerabilidad se corrige en la versión 5.3.5.
First Time Naturalintelligence
Naturalintelligence fast-xml-parser

20 Feb 2026, 21:19

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-20 21:19

Updated : 2026-03-02 14:54

NVD link : CVE-2026-25896

Mitre link : CVE-2026-25896

CVE.ORG link : CVE-2026-25896

JSON object : View

Products Affected

naturalintelligence

  • fast-xml-parser
CWE
CWE-185

Incorrect Regular Expression