fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (&lt;, &gt;, &amp;, &quot;, &apos;) with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without     C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is     treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML     entities (<, >, &, , ') with arbitrary values. This bypasses entity encoding and     leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5. (CVE-2026-25896)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without
    C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is
    treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML
    entities (&lt;, &gt;, &amp;, &quot;, &apos;) with arbitrary values. This bypasses entity encoding and
    leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5. (CVE-2026-25896)

ID	Name	Product	Family	Severity
299725	Linux Distros Unpatched Vulnerability : CVE-2026-25896	Nessus	Misc.	high
437911	SCA: security update for fast-xml-parser (GHSA-m7jm-9gc2-mpf2)	Tenable Cloud Security	SCA Checks	high
437911	SCA: security update for fast-xml-parser (GHSA-m7jm-9gc2-mpf2)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-25896

high

Tenable Plugins

high

high

high