by Kastro CVE-2026-25896
NaturalIntelligence fast-xml-parser — fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
Description · from the CVE record
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5.
Affected
ProductAffectedFixed inSource
fast-xml-parser>= 5.0.0, < 5.3.5–CNA
fast-xml-parser>= 4.1.3, < 4.5.4–CNA
Red Hat Advanced Cluster Security 4.8see advisory1775594119redhat-SADP
Red Hat Advanced Cluster Security 4.9see advisory1775594284redhat-SADP
Red Hat Developer Hub 1.8see advisory1774545605redhat-SADP
Red Hat Developer Hub 1.9see advisory1775140647redhat-SADP
Red Hat Openshift Data Foundation 4.18see advisory1783676191redhat-SADP
Red Hat Openshift Data Foundation 4.18see advisory1783929816redhat-SADP
Red Hat Openshift Data Foundation 4.18see advisory1784094353redhat-SADP
Red Hat Openshift Data Foundation 4.18see advisory1784093953redhat-SADP
Red Hat Openshift Data Foundation 4.18see advisory1784094943redhat-SADP
Red Hat Openshift Data Foundation 4.18see advisory1783676585redhat-SADP
Scores by source
GitHub_M (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
redhat-SADP (CNA)7.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: partial