CVE-2026-25896

The vulnerability results from improper handling of dot (.) characters in entity names defined in the DOCTYPE section of an XML document — CWE-185 (regular expression error). The dot character is treated as a regex wildcard, allowing an attacker to define an entity whose name matches the names of built-in XML entities. As a result, the attacker can substitute arbitrary values in place of standard entities such as < or >, effectively bypassing their encoding mechanism. When the result of processing such an XML document is subsequently rendered in a browser, the injected HTML or JavaScript code is executed.

An attacker can trigger arbitrary JavaScript code execution in the context of the victim's browser (XSS), enabling session theft, credential theft, or performing actions on behalf of the user. Due to the changed scope (Scope: Changed), the impact may extend beyond the directly attacked application.

Update the fast-xml-parser library to version 5.3.5 or later. The fix is available in the official v5.3.5 release in the vendor's GitHub repository.

Naturalintelligence fast-xml-parser library in versions from 4.1.3 to before 5.3.5 (inclusive).