fast-xml-parser XMLBuilder versions prior to 5.7.0 do not escape the '-->' sequence in XML comment content or the ']]>' sequence in CDATA sections. This allows an attacker controlling input data to inject arbitrary XML or script content by breaking out of comment or CDATA contexts, leading to potential XSS, SOAP injection, or XML manipulation.