CVE-2026-25896

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-25896

9.3 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

f

ast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5.

References
Link Resource
https://github.com/NaturalIntelligence/fast-xml-parser/commit/943ef0eb1b2d3284e72dd74f44a042ee9f07026e Patch
https://github.com/NaturalIntelligence/fast-xml-parser/commit/ddcd0acf26ddd682cb0dc15a2bd6aa3b96bb1e69 Patch
https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.5 Product Release Notes
https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-m7jm-9gc2-mpf2 Exploit Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:*
History

02 Mar 2026, 14:54

Type Values Removed Values Added
First Time Naturalintelligence
Naturalintelligence fast-xml-parser
Summary
  • (es) fast-xml-parser permite a los usuarios validar XML, analizar XML a objeto JS, o construir XML desde objeto JS sin librerías basadas en C/C++ y sin callback. Desde la versión 4.1.3 hasta antes de la 5.3.5, un punto (.) en un nombre de entidad DOCTYPE es tratado como un comodín de expresión regular durante el reemplazo de entidades, permitiendo a un atacante sombrear entidades XML incorporadas (<, >, &, ", ') con valores arbitrarios. Esto omite la codificación de entidades y conduce a XSS cuando la salida analizada es renderizada. Esta vulnerabilidad se corrige en la versión 5.3.5.
References () https://github.com/NaturalIntelligence/fast-xml-parser/commit/943ef0eb1b2d3284e72dd74f44a042ee9f07026e - () https://github.com/NaturalIntelligence/fast-xml-parser/commit/943ef0eb1b2d3284e72dd74f44a042ee9f07026e - Patch
References () https://github.com/NaturalIntelligence/fast-xml-parser/commit/ddcd0acf26ddd682cb0dc15a2bd6aa3b96bb1e69 - () https://github.com/NaturalIntelligence/fast-xml-parser/commit/ddcd0acf26ddd682cb0dc15a2bd6aa3b96bb1e69 - Patch
References () https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.5 - () https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.5 - Product, Release Notes
References () https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-m7jm-9gc2-mpf2 - () https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-m7jm-9gc2-mpf2 - Exploit, Mitigation, Vendor Advisory
CPE cpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:*

20 Feb 2026, 21:19

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-20 21:19

Updated : 2026-03-02 14:54

NVD link : CVE-2026-25896

Mitre link : CVE-2026-25896

CVE.ORG link : CVE-2026-25896

JSON object : View

Products Affected

naturalintelligence

CWE
CWE-185

Incorrect Regular Expression