Fast‑xml‑builder builds XML from JSON. Prior to version 1.1.7, if a JSON attribute value contains quotation marks and the builder is run with entity processing disabled, the value is broken into several attributes. An attacker can then insert arbitrary attributes into the resulting XML/HTML. This allows the insertion of malicious or unwanted attributes, potentially enabling cross‑site scripting, data tampering, or other forms of content injection depending on how the output is used.

NaturalIntelligence’s Fast‑xml‑builder library is affected in all releases prior to 1.1.7. Any project that incorporates an older version of this library and processes JSON containing quoted attribute values without entity processing is vulnerable. The vulnerability is fixed in version 1.1.7 and later.

The CVSS score of 6.1 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit this flaw by supplying crafted JSON input containing quotes in attribute values to a system that uses fast‑xml‑builder with entity processing turned off. If the generated XML or HTML is rendered in a browser or used in further processing, the injected attributes could lead to code execution or data tampering. Mitigation is best achieved by applying the vendor‑provided patch or by sanitizing input.