# CVE-2026-41650

## Summary

- **CVE ID:** CVE-2026-41650
- **Severity:** MEDIUM
- **CVSS Score:** 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **CWE:** CWE-91
- **Published:** May 7, 2026
- **Last Modified:** May 7, 2026

## Description

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the "-->" sequence in comment content or the "]]>" sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation. This issue has been patched in version 5.7.0.

## Affected Products

- NaturalIntelligence — fast-xml-parser (< 5.7.0)

## References

- [CNA](https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-gh4j-gqv2-49f6)
- [CNA](https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.6.0)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.24%
- **EPSS Percentile:** 14.8

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-11._