The fast-xml-parser library, used for XML validation and parsing without native dependencies, has a vulnerability (CVE-2026-25896) in versions >=4.1.3 and <5.3.5. The vulnerability arises because a dot character in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, enabling attackers to shadow standard XML entities such as &lt;, &gt;, &amp;, &quot;, and &apos; with arbitrary values. This behavior bypasses entity encoding protections and can lead to cross-site scripting (XSS) when the XML output is rendered in a context that executes scripts. The vulnerability is classified under CWE-185 (Incorrect Regular Expression) and CWE-79 (Cross-Site Scripting). The issue has been addressed and fixed in version 5.3.5 of fast-xml-parser. Red Hat has published advisories and errata addressing this vulnerability and providing updated packages.

An attacker can exploit this vulnerability to bypass XML entity encoding by using a crafted DOCTYPE entity name containing a dot, which is treated as a regex wildcard. This allows the attacker to replace built-in XML entities with arbitrary values, resulting in cross-site scripting (XSS) when the parsed XML output is rendered. The CVSS v3.1 score is 9.3 (critical), indicating high impact with network attack vector, low attack complexity, no privileges or user interaction required, and scope change. The vulnerability impacts confidentiality and integrity but not availability.

A fix is available in fast-xml-parser version 5.3.5. Users and organizations should upgrade to version 5.3.5 or later to remediate this vulnerability. Red Hat has issued security advisories and errata with updated packages addressing this issue. No additional mitigation steps are required if the fixed version is deployed.