GHSA-m7jm-9gc2-mpf2 — fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names

Affected: npm: fast-xml-parser

# Entity encoding bypass via regex injection in DOCTYPE entity names

## Summary

A dot (`.`) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (`<`, `>`, `&`, `"`, `'`) with arbitrary values. This bypasses entity encoding and leads to XSS when parsed output is rendered.

## Details

The fix for CVE-2023-34104 addressed some regex metacharacters in entity names but missed `.` (period), which is valid in XML names per the W3C spec.

In `DocTypeReader.js`, entity names are passed directly to `RegExp()`:

```js entities[entityName] = { regx: RegExp(`&${entityName};`, "g"), val: val }; ```

An entity named `l.` produces the regex `/&l.;/g` where `.` matches **any character**, including the `t` in `<`. Since DOCTYPE entities are replaced before built-in entities, this shadows `<` entirely.

The same issue exists in `OrderedObjParser.js:81` (`addExternalEntities`), and in the v6 codebase - `EntitiesParser.js` has a `validateEntityName` function with a character blacklist, but `.` is not included:

```js // v6 EntitiesParser.js line 96 const specialChar = "!?\\/[]$%{}^&*()<>|+"; // no dot ```

## Shadowing all 5 built-in entities

| Entity name | Regex created | Shadows | |---|---|---| | `l.` | `/&l.;/g` | `<` | | `g.` | `/&g.;/g` | `>` | | `am.` | `/&am.;/g` | `&` | | `quo.` | `/&quo.;/g` | `"` | | `apo.` | `/&apo.;/g` | `'` |

## PoC

```js…

Most recent entries from all

GHSA-m7jm-9gc2-mpf2 — fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names