fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (&lt;, &gt;, &amp;, &quot;, &apos;) with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without
    C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is
    treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML
    entities (&lt;, &gt;, &amp;, &quot;, &apos;) with arbitrary values. This bypasses entity encoding and
    leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5. (CVE-2026-25896)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without     C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is     treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML     entities (<, >, &, , ') with arbitrary values. This bypasses entity encoding and     leads to XSS when parsed output is rendered. This vulnerability is fixed in 5.3.5. (CVE-2026-25896)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
458901	Echo: fast-xml-parser: security update to 4.5.4	Tenable Cloud Security	Echo Local Security Checks	Local	high
458901	Echo: fast-xml-parser: security update to 4.5.4	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
299725	Linux Distros Unpatched Vulnerability : CVE-2026-25896	Nessus	Misc.	Local	high
437911	SCA: security update for fast-xml-parser (GHSA-m7jm-9gc2-mpf2)	Tenable Cloud Security	SCA Checks	Local	high
437911	SCA: security update for fast-xml-parser (GHSA-m7jm-9gc2-mpf2)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-25896

high

Tenable Plugins

high

high

high

high

high