fast‑xml-parser incorrectly treats a dot (.) in a DOCTYPE entity name as a wildcard during entity replacement, allowing an attacker to define custom entities that shadow the XML built‑in entities (<, >, &, &quot;, &apos;). When parsed XML is rendered, the attacker’s injected content can be executed as script, resulting in cross‑site scripting. This flaw is a classic example of improper handling of external entities, as identified by CWE‑185 and CWE‑79.

The vulnerability affects instances of NaturalIntelligence fast‑xml-parser versions from 4.1.3 up through 5.3.4. All users of these releases should verify the installed version and ensure a non‑vulnerable release is in use.

With a CVSS score of 9.3, this issue is considered high‑severity. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, it is inferred that any party that can supply XML input that the application parses can trigger the flaw. This suggests the attacker could potentially exploit the vulnerability remotely if the parser is exposed to untrusted input.