Bug 2467758 (CVE-2026-41650)

Summary: CVE-2026-41650 fast-xml-parser: fast-xml-parser: XML injection via improper escaping of comment and CDATA sequences
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aazores, abarbaro, abuckta, alizardo, anjoseph, anthomas, caswilli, cmah, dkuc, dschmidt, eaguilar, ebaron, ehelms, erezende, ewittman, fdeutsch, ggainey, janstey, jchui, jhe, jlanda, jolong, jprabhak, juwatts, kaycoth, kshier, ktsao, manissin, mhulan, nboldt, nipatil, nmoumoul, oaljalju, orabin, oramraz, osousa, pantinor, pcreech, pjindal, psrna, rchan, rjohnson, rkubis, simaishi, smallamp, smcdonal, smullick, stcannon, stirabos, teagle, thason, tmalecek, wtam, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in fast-xml-parser. The XMLBuilder component does not properly escape specific sequences ("-->" in comments and "]]>" in CDATA sections) when constructing XML from JavaScript objects. This vulnerability allows an attacker to perform XML injection if user-controlled data is processed within comments or CDATA elements. Successful exploitation can lead to Cross-Site Scripting (XSS), SOAP injection, or unauthorized data manipulation.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-05-07 15:02:16 UTC
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the "-->" sequence in comment content or the "]]>" sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation. This issue has been patched in version 5.7.0.