The fast-xml-parser library versions >=4.1.3 and <5.3.5 contain a flaw where a dot character in a DOCTYPE entity name is incorrectly treated as a regular expression wildcard during entity replacement. This incorrect handling allows an attacker to shadow built-in XML entities such as &lt;, &gt;, &amp;, &quot;, and &apos; with arbitrary values. As a result, entity encoding can be bypassed, leading to Cross-Site Scripting (CWE-79) when the parsed XML output is subsequently rendered in a user context. The vulnerability has a CVSS v3.1 score of 9.3 (critical) and is fixed in version 5.3.5 of fast-xml-parser. Red Hat classifies this flaw as important for its products, noting that the impact is limited to the user's browser context and requires user interaction to trigger the XSS. No known exploits are reported in the wild. The vendor advisory and Red Hat advisory confirm the vulnerability and the availability of a fix in version 5.3.5.

This vulnerability allows an attacker to bypass XML entity encoding protections and inject arbitrary scripts into the parsed XML output. When this output is rendered in a user's browser, it can lead to Cross-Site Scripting (XSS), potentially enabling unauthorized code execution in the context of the victim's browser. The impact is limited to the confidentiality and integrity of the user's browser session and does not affect system availability. The vulnerability requires that the malicious XML be parsed and the output rendered to a user, thus involving user interaction. No active exploitation has been reported.

A fix is available in fast-xml-parser version 5.3.5. Users and vendors are advised to upgrade to this version to remediate the vulnerability. Red Hat currently has no alternative mitigations that meet their criteria for ease of use and applicability. Therefore, upgrading to the fixed version is the recommended remediation.