Skip to content
Fencer Vulns
critical 9.3

CVE-2026-25896 json

fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

published 2026-02-20 8 mo ago modified 2026-09-10 59 d ago also EUVD-2026-7529 , GHSA-m7jm-9gc2-mpf2

cvss
9.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 44%
public exploits
0
none known

Summary

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5.

Patch / fix

  • npm fast-xml-parser 4.5.4, 5.3.5
  • Red Hat Red Hat Advanced Cluster Security 4.8 1775594119
  • Red Hat Red Hat Advanced Cluster Security 4.9 1775594284
  • Red Hat Red Hat Developer Hub 1.8 1774545605
  • Red Hat Red Hat Developer Hub 1.9 1775140647
  • Red Hat Red Hat Openshift Data Foundation 4.18 1783676191, 1783676585, 1783676649, 1783676675, 1783676820, 1783676883, 1783676894, 1783676977, 1783677297, 1783677345, 1783677533, 1783929816, 1784093503, 1784093953, 1784094299, 1784094353, 1784094725, 1784094943, 1784095175
  • Red Hat Red Hat Openshift Data Foundation 4.19 1783684068, 1783684360, 1783684603, 1783684667, 1783684668, 1783684707, 1783684779, 1783684831, 1783684839, 1783685128, 1783685129, 1783685375, 1784054582, 1784054606, 1784054873, 1784055295, 1784055533, 1784055558, 1784055589, 1784056134
  • Red Hat Red Hat Openshift Data Foundation 4.20 1783666755, 1783667125, 1783667517, 1783667577, 1783667611, 1783667641, 1783667790, 1783667859, 1783667869, 1783667875, 1783667877, 1783668266, 1784054598, 1784055020, 1784055244, 1784055382, 1784055387, 1784055576, 1784055586, 1784055726
  • Red Hat Red Hat Satellite 6.18 1785922764

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-25896 updated cvss 7.1

fast-xml-parser: fast-xml-parser: Cross-Site Scripting (XSS) due to improper DOCTYPE entity handling

  • Red Hat Migration Toolkit for Applications 8 mta/mta-ui-rhel9
    affected: workaround, no fix available
  • Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin, container-native-virtualization/kubevirt-console-plugin-rhel9 Red Hat Self-service automation portal 2 ansible-automation-platform/automation-portal
    affected: workaround, no fix available
  • Red Hat Advanced Cluster Security 4.8 advanced-cluster-security 1775594119
    fixed: vendor fix RHSA-2026:7110
  • Red Hat Advanced Cluster Security 4.9 advanced-cluster-security 1775594284
    fixed: vendor fix RHSA-2026:7128
  • Red Hat Developer Hub 1.8 rhdh 1774545605
    fixed: vendor fix RHSA-2026:6174
  • Red Hat Developer Hub 1.9 rhdh 1775140647
    fixed: vendor fix RHSA-2026:6802
  • Red Hat Openshift Data Foundation 4.18 odf4/cephcsi-rhel9 1783676191, odf4/odf-cli-rhel9 1784094299, odf4/mcg-core-rhel9 1784094353, odf4/odf-console-rhel9 1784094725, odf4/mcg-rhel9-operator 1784093953, odf4/ocs-rhel9-operator 1783676675, +13 more
    fixed: vendor fix RHSA-2026:41941
show 5 more
  • Red Hat Openshift Data Foundation 4.19 odf4/cephcsi-rhel9 1783684360, odf4/odf-cli-rhel9 1784054873, odf4/mcg-core-rhel9 1784054582, odf4/odf-console-rhel9 1784055589, odf4/mcg-rhel9-operator 1784054606, odf4/ocs-rhel9-operator 1783684667, +14 more
    fixed: vendor fix RHSA-2026:41944
  • Red Hat Openshift Data Foundation 4.20 odf4/cephcsi-rhel9 1783667125, odf4/odf-cli-rhel9 1784055020, odf4/mcg-core-rhel9 1784054598, odf4/odf-console-rhel9 1784055586, odf4/mcg-rhel9-operator 1784055387, odf4/ocs-rhel9-operator 1783667611, +16 more
    fixed: vendor fix RHSA-2026:40984
  • Red Hat Satellite 6.18 satellite/iop-host-inventory-frontend-rhel9 1785922764
    fixed: vendor fix RHSA-2026:51349
  • Red Hat Advanced Cluster Security 4.8 advanced-cluster-security 1774163438, advanced-cluster-security 1774294180, advanced-cluster-security 1775594119 Red Hat Advanced Cluster Security 4.9 advanced-cluster-security 1774260292, advanced-cluster-security 1774294136, advanced-cluster-security 1775594284 Red Hat Developer Hub 1.8 rhdh 1774544220, rhdh 1774549552 Red Hat Developer Hub 1.9 rhdh 1775140369, rhdh 1775155242 Red Hat Openshift Data Foundation 4.18 odf4/mcg-operator-bundle 1784096858, odf4/ocs-operator-bundle 1784097072, odf4/odf-operator-bundle 1784097342, odf4/cephcsi-operator-bundle 1784096750, odf4/odr-hub-operator-bundle 1784097501, odf4/rook-ceph-operator-bundle 1784098364, +7 more Red Hat Openshift Data Foundation 4.19 odf4/mcg-operator-bundle 1784058120, odf4/ocs-operator-bundle 1784058383, odf4/odf-operator-bundle 1784058758, odf4/cephcsi-operator-bundle 1784057956, odf4/odr-hub-operator-bundle 1784058873, odf4/rook-ceph-operator-bundle 1784059042, +7 more
    +1 more products
    Red Hat Openshift Data Foundation 4.20 odf4/mcg-operator-bundle 1784058849, odf4/ocs-operator-bundle 1784059112, odf4/odf-operator-bundle 1784060452, odf4/cephcsi-operator-bundle 1784058684, odf4/odr-hub-operator-bundle 1784060213, odf4/rook-ceph-operator-bundle 1784059800, +8 more
    not affected: vulnerable code not present
  • Red Hat Satellite 6 satellite/iop-vulnerability-frontend-rhel9
    not affected: component not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
8 mo ago

Exploit prediction

0.53% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-m7jm-9gc2-mpf2 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
CISA ADP 3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
GitHub 3.1 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N
CNA 3.1 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Affected packages

ecosystem package affected fixed in
npm fast-xml-parser
>=5.0.0, <5.3.5
>=4.1.3, <4.5.4
5.3.5
4.5.4

Affected products

  • NaturalIntelligence fast-xml-parser
  • Red Hat Red Hat Advanced Cluster Security 4.8
  • Red Hat Red Hat Advanced Cluster Security 4.9
  • Red Hat Red Hat Developer Hub 1.8
  • Red Hat Red Hat Developer Hub 1.9
  • Red Hat Red Hat Openshift Data Foundation 4.18
  • Red Hat Red Hat Openshift Data Foundation 4.19
  • Red Hat Red Hat Openshift Data Foundation 4.20
  • Red Hat Red Hat Satellite 6.18
  • Red Hat Migration Toolkit for Applications 8
  • Red Hat Red Hat OpenShift GitOps
  • Red Hat Red Hat OpenShift Virtualization 4
  • Red Hat Red Hat Satellite 6
  • Red Hat Self-service automation portal 2

Classification

Weakness
  • CWE-185 Incorrect Regular Expression
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.