Technical impact
XMLBuilder in fast-xml-parser does not escape certain delimiter sequences (e.g., the comment end marker '-->' and the CDATA end marker ']]>') when constructing XML from JavaScript objects. This missing sanitization creates an injection point that attackers can exploit with user‑controlled data to place arbitrary XML content. The impact includes cross‑site scripting, SOAP envelope alteration, and other forms of data manipulation, a classic example of XML Injection (CWE‑91).
Affected Systems
All deployments of NaturalIntelligence's fast‑xml‑parser prior to version 5.7.0 are affected. The vulnerability exists in the XMLBuilder module that builds XML from JavaScript objects. Any system that imports or uses fast‑xml‑parser before the patch may be compromised if it processes untrusted input.
Risk and Exploitability
The CVSS score of 6.1 indicates a moderate severity with potential for significant impact. The EPSS score is not available, so the likelihood of exploitation cannot be quantified precisely, but the vulnerability is not listed in the CISA KEV catalog. Attackers can inject malicious content by providing crafted input that reaches XMLBuilder. The required conditions are that the application builds XML from untrusted data; based on the description, it is inferred that no additional authentication or sandboxing is required, implying a relatively straightforward exploitation path.
Github GHSA