GHSA-gh4j-gqv2-49f6 — fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters

Affected: npm: fast-xml-parser

# fast-xml-parser XMLBuilder: Comment and CDATA Injection via Unescaped Delimiters

## Summary

fast-xml-parser XMLBuilder does not escape the `-->` sequence in comment content or the `]]>` sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation.

Existing CVEs for fast-xml-parser cover different issues: - CVE-2023-26920: Prototype pollution (parser) - CVE-2023-34104: ReDoS (parser) - CVE-2026-27942: Stack overflow in XMLBuilder with preserveOrder - CVE-2026-25896: Entity encoding bypass via regex in DOCTYPE entities

This finding covers **unescaped comment/CDATA delimiters in XMLBuilder** - a distinct vulnerability.

## Vulnerable Code

**File**: `src/fxb.js`

```javascript // Line 442 - Comment building with NO escaping of --> buildTextValNode(val, key, attrStr, level) { // ... if (key === this.options.commentPropName) { return this.indentate(level) + `` + this.newLine; // VULNERABLE } // ... if (key === this.options.cdataPropName) { return this.indentate(level) + `<![CDATA[${val}]]>` + this.newLine; // VULNERABLE } } ```

Compare with attribute/text escaping which IS properly handled via `replaceEntitiesValue()`.

## Proof of Concept

### Test 1: Comment Injection (XSS in SVG/HTML context)

```javascript import { XMLBuilder } from 'fast-xml-parser';

const builde…

Most recent entries from all

GHSA-gh4j-gqv2-49f6 — fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters