CVE-2026-41650: XML Injection (aka Blind XPath Injection)

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the "--" sequence in comment content or the "" sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection...

GHSA-GH4J-GQV2-49F6 fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters

fast-xml-parser XMLBuilder: Comment and CDATA Injection via Unescaped Delimiters Summary fast-xml-parser XMLBuilder does not escape the -- sequence in comment content or the sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data...

fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters

fast-xml-parser XMLBuilder: Comment and CDATA Injection via Unescaped Delimiters Summary fast-xml-parser XMLBuilder does not escape the -- sequence in comment content or the sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data...

GHSA-FJ3W-JWP8-X2G3 fast-xml-parser has stack overflow in XMLBuilder with preserveOrder

Impact Application crashes with stack overflow when user use XML builder with prserveOrder:true for following or similar input 'foo': 'bar': '@V': 'baz' Cause: arrToStr was not validating if the input is an array or a string and treating all non-array values as text content. What kind of...

Buffer Overflow

Overview fast-xml-parser is a Validate XML, Parse XML, Build XML without C/C++ based libraries Affected versions of this package are vulnerable to Buffer Overflow via the XMLBuilder when preserveOrder:true is set. An attacker can cause the application to crash by providing specially crafted input...

Buffer Overflow

Overview org.webjars.npm:fast-xml-parser is a Validate XML, Parse XML, Build XML without C/C++ based libraries Affected versions of this package are vulnerable to Buffer Overflow via the XMLBuilder when preserveOrder:true is set. An attacker can cause the application to crash by providing special...

CVE-2026-27942 fast-xml-parser has stack overflow in XMLBuilder with preserveOrder

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with preserveOrder:true. Version 5.3.8 fixes the issue. As...

Linux Distros Unpatched Vulnerability : CVE-2014-125087

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in java-xmlbuilder up to 1.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation...

fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name

Impact As a part of this vulnerability, user was able to se code using proto as a tag or attribute name. js const XMLParser, XMLBuilder, XMLValidator = require"fast-xml-parser"; let XMLdata = "hacked" const parser = new XMLParser; let jObj = parser.parseXMLdata; console.logjObj.polluted // should...

org.jspringbot:jspringbot-function-generator (>=1.0, <=1.9), org.jspringbot:jspringbot-http (>=1.0, <=1.9) +1 more potentially affected by CVE-2014-125087 via com.jamesmurty.utils:java-xmlbuilder (0.6)

com.jamesmurty.utils:java-xmlbuilder MAVEN version 0.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.jamesmurty.utils:java-xmlbuilder and may be impacted: - org.jspringbot:jspringbot-function-generator =1.0, =1.0, =1.0, =1.9 Source cves:...

ai.catboost:catboost-spark_2.11 (>=0.25-rc1, <=0.25-rc3), ai.catboost:catboost-spark_2.12 (>=0.25-rc1, <=0.25-rc3) +2213 more potentially affected by CVE-2014-125087 via com.jamesmurty.utils:java-xmlbuilder (0.4)

com.jamesmurty.utils:java-xmlbuilder MAVEN version 0.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.jamesmurty.utils:java-xmlbuilder and may be impacted: - ai.catboost:catboost-spark2.11 =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =3.16.0....

ai.databand:dbnd-agent (>=0.42.1, <=0.78.8), ai.grakn.kgms:client (1.4.3) +935 more potentially affected by CVE-2014-125087 via com.jamesmurty.utils:java-xmlbuilder (>=1.0, <=1.1)

com.jamesmurty.utils:java-xmlbuilder MAVEN version =1.0, =0.42.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.3 and more Source cves: CVE-2014-125087 Source advisory: OSV:GHSA-3VRC-RRPW-R5PW...

net.java.dev.jets3t:cockpit (0.7.4), net.java.dev.jets3t:jets3t (0.7.4) +44 more potentially affected by CVE-2014-125087 via com.jamesmurty.utils:java-xmlbuilder (0.3)

com.jamesmurty.utils:java-xmlbuilder MAVEN version 0.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.jamesmurty.utils:java-xmlbuilder and may be impacted: - net.java.dev.jets3t:cockpit 0.7.4 - net.java.dev.jets3t:jets3t 0.7.4 -...

java-xmlbuilder vulnerable to XML External Entity Reference

A vulnerability was found in java-xmlbuilder up to 1.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. Upgrading to version 1.2 is able to address this issue. The name of the patch is...

GHSA-3VRC-RRPW-R5PW java-xmlbuilder vulnerable to XML External Entity Reference

A vulnerability was found in java-xmlbuilder up to 1.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. Upgrading to version 1.2 is able to address this issue. The name of the patch is...

ai.databand:dbnd-agent (>=0.42.1, <=0.78.8), ai.grakn.kgms:client (1.4.3) +935 more potentially affected by CVE-2014-125087 via com.jamesmurty.utils:java-xmlbuilder (>=1.0, <=1.1)

com.jamesmurty.utils:java-xmlbuilder MAVEN version =1.0, =0.42.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.3 and more Source cves: CVE-2014-125087 Source advisory: GHSA-3VRC-RRPW-R5PW...

CVE-2014-125087

A vulnerability was found in java-xmlbuilder up to 1.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. Upgrading to version 1.2 is able to address this issue. The name of the patch is...

Xxe

A vulnerability was found in java-xmlbuilder up to 1.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. Upgrading to version 1.2 is able to address this issue. The name of the patch is...

CVE-2014-125087

A vulnerability was found in java-xmlbuilder up to 1.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. Upgrading to version 1.2 is able to address this issue. The name of the patch is...

UBUNTU-CVE-2014-125087

A vulnerability was found in java-xmlbuilder up to 1.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. Upgrading to version 1.2 is able to address this issue. The name of the patch is...