CVE-2026-25896

Fixed in a distro release EPSS <1%CVSS 9.3

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (&lt;, &gt;, &amp;, &quot;, &apos;) with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5.

Published 2026-02-20 · CVE record · OSV

Products: NaturalIntelligence fast-xml-parser, Red Hat Advanced Cluster Security 4.8, Red Hat Advanced Cluster Security 4.9, Red Hat Developer Hub 1.8, Red Hat Developer Hub 1.9, Red Hat Openshift Data Foundation 4.18, Red Hat Openshift Data Foundation 4.19, Red Hat Openshift Data Foundation 4.20, Red Hat Satellite 6.18, Red Hat Migration Toolkit for Applications 8, Red Hat OpenShift GitOps, Red Hat OpenShift Virtualization 4, Red Hat Satellite 6, Red Hat Self-service automation portal 2

Fixed upstream

Distro releases