~ / search / GHSA-776f-qx25-q3cc

GHSA-776f-qx25-q3cc

xml2js is vulnerable to prototype pollution

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-0842

Packages

EcosystemPackageAffectedFixed in
npm xml2js < 0.5.0 0.5.0

Details

As written in the advisory (Markdown source, shown as plain text).

xml2js versions before 0.5.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the `__proto__` property to be edited.

References

External links from the advisory. They lead to third-party sites.