CVE-2026-41650
MediumAdvisory
Published 22 Apr 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.1
- base score, highest
- EPSS
- 0.002
- 15th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 121
- of 17,781 indexed, latest versions
- Container images
- 118
- deployed by those charts
- Fix available
- 1 of 1
- affected package
fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters
Carried by container images the latest versions of 121 of 17,781 indexed charts deploy, on 118 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| fast-xml-parsernpm | 3.19.0, 3.21.1, 4.0.11, 4.1.2+20 more | 5.7.0 | 118 |
- OSV records
- GHSA-gh4j-gqv2-49f6
Charts affected
121 by stars
Container images carrying it
118 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| quay.io/ | 709c7da19c5a | fast-xml-parser | 5.7.0 | 3 |
| agoldis/ | 10228ecd353b | fast-xml-parser | 5.7.0 | 2 |
| library/ | 1b23d7976f02 | fast-xml-parser | 5.7.0 | 2 |
| louislam/ | 9aeb4e51d038 | fast-xml-parser | 5.7.0 | 2 |
| mojaloop/ | 1e0d24d28512 | fast-xml-parser | 5.7.0 | 2 |
| mojaloop/ | 265102a049d6 | fast-xml-parser | 5.7.0 | 2 |
| mojaloop/ | 12af60892c75 | fast-xml-parser | 5.7.0 | 2 |
| rajnandan1/ | 30407afca731 | fast-xml-parser | 5.7.0 | 2 |
| quay.io/ | e09967519a1d | fast-xml-parser | 5.7.0 | 2 |
| activepieces/ | 30c10a04fe3d | fast-xml-parser | 5.7.0 | 1 |
| adeptiainc/ | 31f295e948e6 | fast-xml-parser | 5.7.0 | 1 |
| automatischio/ | 3bace7a12d5f | fast-xml-parser | 5.7.0 | 1 |
| bicarus/ | dab88659ae3b | fast-xml-parser | 5.7.0 | 1 |
| budibase/ | 44fe6feab985 | fast-xml-parser | 5.7.0 | 1 |
| chibisafe/ | 3da4fcbc1a18 | fast-xml-parser | 5.7.0 | 1 |
| chocobozzz/ | 052712130691 | fast-xml-parser | 5.7.0 | 1 |
| continuoussecuritytooling/ | f04ecefab64e | fast-xml-parser | 5.7.0 | 1 |
| countly/ | f4cc7447c4f5 | fast-xml-parser | 5.7.0 | 1 |
| countly/ | e3c238248f99 | fast-xml-parser | 5.7.0 | 1 |
| countly/ | 2acbc11499b6 | fast-xml-parser | 5.7.0 | 1 |
| cryptexlabs/ | 189c07411d7c | fast-xml-parser | 5.7.0 | 1 |
| directus/ | e3c8bb975350 | fast-xml-parser | 5.7.0 | 1 |
| documenso/ | 7f16a9449f18 | fast-xml-parser | 5.7.0 | 1 |
| drumsergio/ | 28244054e1bf | fast-xml-parser | 5.7.0 | 1 |
| ducktors/ | 31ec9e83c844 | fast-xml-parser | 5.7.0 | 1 |
| ethpandaops/ | 7a9ab6370657 | fast-xml-parser | 5.7.0 | 1 |
| ethpandaops/ | c58eb9ffe446 | fast-xml-parser | 5.7.0 | 1 |
| evoapicloud/ | 966625532d90 | fast-xml-parser | 5.7.0 | 1 |
| fallenbagel/ | 4538137bc5af | fast-xml-parser | 5.7.0 | 1 |
| fosrl/ | c32ad797ab96 | fast-xml-parser | 5.7.0 | 1 |
| ianw/ | dc49dd460c37 | fast-xml-parser | 5.7.0 | 1 |
| joplin/ | 3f7b852959aa | fast-xml-parser | 5.7.0 | 1 |
| joplin/ | 52af57880c0e | fast-xml-parser | 5.7.0 | 1 |
| joplin/ | b87564ef34e9 | fast-xml-parser | 5.7.0 | 1 |
| library/ | 2654b1e90413 | fast-xml-parser | 5.7.0 | 1 |
| library/ | 767230c0f263 | fast-xml-parser | 5.7.0 | 1 |
| library/ | 83f7bf209844 | fast-xml-parser | 5.7.0 | 1 |
| library/ | ac533a6988ee | fast-xml-parser | 5.7.0 | 1 |
| library/ | 04c0fc150f3a | fast-xml-parser | 5.7.0 | 1 |
| library/ | 1aae00775251 | fast-xml-parser | 5.7.0 | 1 |
| lobehub/ | da0c21fefcd3 | fast-xml-parser | 5.7.0 | 1 |
| louislam/ | 059b49d64739 | fast-xml-parser | 5.7.0 | 1 |
| louislam/ | 0b55bcb83a1c | fast-xml-parser | 5.7.0 | 1 |
| louislam/ | 3d632903e6af | fast-xml-parser | 5.7.0 | 1 |
| louislam/ | 4c364ef96aad | fast-xml-parser | 5.7.0 | 1 |
| louislam/ | 96510915e6be | fast-xml-parser | 5.7.0 | 1 |
| louislam/ | 9865163f92c1 | fast-xml-parser | 5.7.0 | 1 |
| louislam/ | bc6f244ecf27 | fast-xml-parser | 5.7.0 | 1 |
| lukasreining/ | 50e021c42e33 | fast-xml-parser | 5.7.0 | 1 |
| mintproject/ | 222e3b941a36 | fast-xml-parser | 5.7.0 | 1 |