CVE-2026-25896

Executive Summary

CVE-2026-25896 is a critical vulnerability in the fast-xml-parser npm package, affecting versions from 4.1.3 up to (but not including) 5.3.5. The flaw resides in the DOCTYPE entity replacement logic, where a dot (.) in an entity name is incorrectly interpreted as a regex wildcard. This allows an attacker to define a malicious entity that shadows built-in XML entities (<, >, &, ", '). When the parsed XML output is rendered in a browser, the attacker-controlled entity values bypass standard encoding, leading to Cross-Site Scripting (XSS). With a CVSS score of 9.3, this vulnerability is considered critical and requires immediate patching.

Supply Chain & Package Security

This vulnerability affects the fast-xml-parser npm package, a widely used library for XML parsing in Node.js applications. The supply chain risk is significant: any application that uses this library to parse untrusted XML input is vulnerable. Attackers can inject malicious XML payloads through user uploads, API requests, or any other data ingestion point. The package is a direct dependency, meaning the vulnerability propagates to all downstream consumers. Organizations must audit their dependency trees and update to version 5.3.5 or later.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over a network.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker only needs to supply a malicious XML payload.
• Privileges Required (PR): None (N) – No authentication or privileges are needed.
• User Interaction (UI): None (N) – The victim does not need to perform any action beyond viewing the parsed output.
• Scope (S): Changed (C) – The vulnerable component impacts resources beyond its security scope (e.g., the browser context).
• Confidentiality (C): High (H) – An attacker can steal sensitive data (cookies, tokens, etc.).
• Integrity (I): High (H) – An attacker can modify the rendered page content.
• Availability (A): High (H) – An attacker can disrupt the application's functionality.

Threat Level: Critical. The combination of network exploitability, low complexity, and high impact makes this a top-priority vulnerability.

Deep Dive & Mechanics

The core issue lies in the entity replacement logic within fast-xml-parser. When parsing a DOCTYPE declaration, the library uses a regex to match entity names. The regex incorrectly treats the dot character (.) as a wildcard (matching any single character) instead of a literal dot. This allows an attacker to define an entity whose name, when matched against built-in entities, shadows them.

For example, consider the built-in entity < which represents the < character. An attacker can define a DOCTYPE entity like <!ENTITY lt "javascript:alert(1)">. Because the regex treats the dot as a wildcard, the entity name lt (without a dot) can be matched by a pattern intended for l.t (where . is a wildcard). This effectively allows the attacker to override the built-in < entity with their own malicious value.

When the parser later encounters < in the XML content, it replaces it with the attacker-defined value instead of the intended < character. If this output is then rendered in a browser (e.g., in a web application), the attacker's JavaScript code executes, resulting in XSS.

Vulnerable vs. Patched Code

Vulnerable Code (version < 5.3.5): The vulnerable code likely uses a regex like /l.t/ to match entity names, where the dot is a wildcard. This allows the attacker to shadow entities.

// Vulnerable regex pattern (conceptual)
const entityRegex = /&(l.t|g.t|amp|quot|apos);/g;

Patched Code (version 5.3.5): The fix escapes the dot in the regex, treating it as a literal character. This prevents the shadowing attack.

// Patched regex pattern (conceptual)
const entityRegex = /&(l\.t|g\.t|amp|quot|apos);/g;

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Create a Node.js application using fast-xml-parser version 4.1.3 or later (but before 5.3.5). The application should parse XML input and render the output in a browser.

2. Craft Payload: Create an XML file with a malicious DOCTYPE entity that shadows <.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY lt "&lt;img src=x onerror=alert(1)&gt;">
]>
<root>&lt;</root>

3. Exploit: Send the XML payload to the vulnerable application. The parser will replace < with the attacker-defined value, which includes an <img> tag with an onerror event handler. When the browser renders the output, the JavaScript alert(1) executes.

Blue Team (Defense & Detection)

1. Detection: Monitor for XML payloads containing DOCTYPE declarations with entity definitions that attempt to shadow built-in entities. Look for patterns like <!ENTITY lt or <!ENTITY gt.

2. Mitigation: Immediately upgrade fast-xml-parser to version 5.3.5 or later. If immediate patching is not possible, implement a Web Application Firewall (WAF) rule to block XML payloads with suspicious DOCTYPE entity definitions.

3. Logging: Enable detailed logging of XML parsing errors and entity replacement activities. Correlate with web server logs to identify potential exploitation attempts.

Indicators of Compromise (IOCs)

• Network: XML payloads containing DOCTYPE declarations with entity names that match built-in entities (e.g., lt, gt, amp, quot, apos).
• Application Logs: Errors or warnings related to entity replacement in fast-xml-parser.
• Browser Behavior: Unexpected JavaScript execution (e.g., alert() dialogs) when viewing parsed XML output.
• File System: Presence of XML files with malicious DOCTYPE definitions in upload directories.

Detection Engineering

YARA Rule

rule CVE_2026_25896_XML_Entity_Shadowing {
    meta:
        description = "Detects XML payloads attempting to exploit CVE-2026-25896 by shadowing built-in entities"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-25896"
    strings:
        $entity_lt = "<!ENTITY lt " ascii nocase
        $entity_gt = "<!ENTITY gt " ascii nocase
        $entity_amp = "<!ENTITY amp " ascii nocase
        $entity_quot = "<!ENTITY quot " ascii nocase
        $entity_apos = "<!ENTITY apos " ascii nocase
    condition:
        any of ($entity_*) and #xml_doctype > 0
}

Sigma Rule

title: CVE-2026-25896 - XML Entity Shadowing Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP requests containing XML payloads with DOCTYPE entity definitions that shadow built-in entities.
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-25896
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'xml'
        cs-body|contains:
            - '<!ENTITY lt '
            - '<!ENTITY gt '
            - '<!ENTITY amp '
            - '<!ENTITY quot '
            - '<!ENTITY apos '
    condition: selection
falsepositives:
    - Legitimate use of custom entities (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-25896 - XML Entity Shadowing Attempt"; flow:to_server,established; content:"POST"; http_method; content:"xml"; http_uri; content:"<!ENTITY lt "; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Upgrade fast-xml-parser to version 5.3.5 or later. Run npm update fast-xml-parser or update the version in your package.json file.

2. Input Validation: Implement strict input validation for XML content. Reject any XML that contains DOCTYPE declarations with entity definitions that match built-in entity names.

3. WAF Rules: Deploy Web Application Firewall rules to block XML payloads with suspicious DOCTYPE entity definitions.

4. Content Security Policy (CSP): Implement a strict CSP header to mitigate the impact of XSS even if the vulnerability is exploited.

5. Regular Audits: Regularly audit your dependency tree for known vulnerabilities using tools like npm audit or Snyk.

Valters IT
Securing Digital Frontiers