GitHub Advisoryadvisory · npm

GHSA-776f-qx25-q3cc xml2js is vulnerable to prototype pollution

MEDIUM Published 2023-04-05 Modified 2025-02-13 Official page ↗
Aliases
CVE-2023-0842
Ecosystem
npm
Packages
xml2js
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-1321
Reviewed
2023-04-07

Affected packages

• npm xml2js: < 0.5.0 → fixed in 0.5.0

Description

xml2js versions before 0.5.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the `__proto__` property to be edited.

Related

Alias · CVE (1)

  • CVE-2023-0842 xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References