fast-xml-builder Comment Value regex can be bypassed
Summary
The fix for https://github.com/advisories/GHSA-gh4j-gqv2-49f6 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace(/--/g, '- -'). This skip the values containing three consecutive dashes (e.g., --->...), allowing an attacker to break out of an XML comment and inject arbitrary XML/HTML content.
Impact
Any application with comment property enabled allow attacker to inject malicious or unwanted code like JS script tag in the XML/HTML output.
Workarounds
Check for the presence of 3 consecutive dashes externally in the property value used for comment tag.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | fast-xml-builder | >= 1.1.5, < 1.1.6 | 1.1.6 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N- Weakness (CWE)
CWE-91- Platform
- npm
- Package
fast-xml-builder- Disclosed
- 08.05.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-45c6-75p6-83cc - CC BY 4.0
Vulnerability history: fast-xml-builder
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 05.2026 05.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 1
- Medium 1
Disclosures per year
- 2026: 2
-
fast-xml-builder Comment Value regex can be bypassed this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.