CWE-91: XML Injection vulnerabilities

fast-xml-builder builds XML from JSON. In 1.1.5, the fix for CVE-2026-41650 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace(/--/g, '- -'). This skip the values containing three consecutive dashes (e.g., --->...), allowing an attacker to break out of an XML comment and inject arbitrary XML/HTML content. This vulnerability is fixed in 1.1.6.

fast-xml-builder builds XML from JSON. Prior to 1.1.7, when an input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into multiple attributes. This gives the room for an attacker to insert unwanted attributes to the XML/HTML. This vulnerability is fixed in 1.1.7.

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to version 5.7.0, XMLBuilder does not escape the "-->" sequence in comment content or the "]]>" sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation. This issue has been patched in version 5.7.0.

Traccar versions from 6.11.1 up to but not including 6.13.0 contain an XML Injection vulnerability in the KML and GPX export functionality. This flaw allows an attacker with low privileges to inject crafted XML content via device names, potentially corrupting exported files and spoofing location data. The issue is resolved in version 6.13.0.

CVE-2026-32870 is an XML Injection vulnerability in the getkirby CMS affecting versions prior to 4.9.0 and between 5.0.0 and before 5.4.0. The issue arises from improper handling of CDATA blocks in the Xml::value() method, allowing structured data outside valid CDATA blocks to bypass escaping protections. This vulnerability can be exploited if site or plugin code uses the vulnerable XML generation methods to create XML strings from input data, potentially enabling manipulation of systems that process these XML files. The vulnerability does not affect Kirby core functionality or sites that do not use XML generation in site or plugin code.

Improper neutralization of special elements in the /IDC_Logging/checkifdone.cgi script in International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web management Interface version 101 allows for XML Injection. The application reflects un-sanitized user input from the `file` parameter directly into a CDATA block, allowing an authenticated attacker to break out of the tags and inject arbitrary XML elements. An actor is confirmed to be able to turn this into an reflected XSS but further abuse such as XXE may be possible

CVE-2026-1554 is an XML Injection vulnerability, specifically a Blind XPath Injection, found in the Drupal Central Authentication System (CAS) Server versions before 2.0.3 and between 2.1.0 and 2.1.2. This vulnerability allows an attacker with limited privileges to escalate their privileges by manipulating XML input used in authentication processes. The CVSS score is 4.2, indicating a medium severity level, with network attack vector but requiring high attack complexity and low privileges.

An XPath Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensitive information from the Firebox configuration through an exposed authentication or management web interface. This vulnerability only affects Firebox systems that have at least one authentication hotspot configured.

Zohocorp ManageEngine EndPoint Central versions 11.4.2516.1 and prior are vulnerable to XML Injection.

Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an XML Injection vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate XML queries and gain limited unauthorized write access.

XML Injection RCE by parse http sitemap xml response vulnerability in Apache HertzBeat. The attacker needs to have an authenticated account with access, and add monitor parsed by xml, returned special content can trigger the XML parsing vulnerability. This issue affects Apache HertzBeat (incubating): before 1.7.0. Users are recommended to upgrade to version 1.7.0, which fixes the issue.

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an XML Injection vulnerability that could lead to arbitrary file system read. An attacker can exploit this issue by injecting crafted XML or XPath queries to access unauthorized files or lead to denial of service. Exploitation of this issue does not require user interaction, and attack must have access to shared secrets.