CVE-2026-44664: Naturalintelligence Fast-XML-Builder

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

fast-xml-builder builds XML from JSON. In 1.1.5, the fix for CVE-2026-41650 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace(/--/g, '- -'). This skip the values containing three consecutive dashes (e.g., --->...), allowing an attacker to break out of an XML comment and inject arbitrary XML/HTML content. This vulnerability is fixed in 1.1.6.

Affected products

• Naturalintelligence Fast-XML-Builder: version 1.1.5 only

Published 2026-05-13. Last modified 2026-06-17.