{"id":"GHSA-45c6-75p6-83cc","summary":"fast-xml-builder Comment Value regex can be bypassed","details":"# Summary\nThe fix for https://github.com/advisories/GHSA-gh4j-gqv2-49f6 in fast-xml-parser sanitizes `--` sequences in XML comment content using .replace(/--/g, '- -'). This skip the values containing three consecutive dashes (e.g., ---\u003e...), allowing an attacker to break out of an XML comment and inject arbitrary XML/HTML content.\n\n### Impact\nAny application with comment property enabled allow attacker to inject malicious or unwanted code like JS script tag in the XML/HTML output.\n\n### Workarounds\nCheck for the presence of 3 consecutive dashes externally in the property value used for comment tag.","aliases":["CVE-2026-44664"],"modified":"2026-09-10T03:51:04.584520301Z","published":"2026-05-08T16:27:28Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-05-08T16:27:28Z","nvd_published_at":"2026-05-13T16:16:58Z","cwe_ids":["CWE-91"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/NaturalIntelligence/fast-xml-builder/security/advisories/GHSA-45c6-75p6-83cc"},{"type":"WEB","url":"https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-gh4j-gqv2-49f6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44664"},{"type":"PACKAGE","url":"https://github.com/NaturalIntelligence/fast-xml-builder"}],"affected":[{"package":{"name":"fast-xml-builder","ecosystem":"npm","purl":"pkg:npm/fast-xml-builder"},"ranges":[{"type":"SEMVER","events":[{"introduced":"1.1.5"},{"fixed":"1.1.6"}]}],"versions":["1.1.5"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-45c6-75p6-83cc/GHSA-45c6-75p6-83cc.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}