MediumGHSA-776f-qx25-q3ccCVE-2023-0842
xml2js is vulnerable to prototype pollution
Published 5 Apr 2023 · Updated 13 Feb 2025
Affected package
xml2jsnpm
- Affected
- <0.5.0
- Fixed in
- 0.5.0
Update to the fixed version for your release line, for example:
npm install xml2js@0.5.0Details
xml2js versions before 0.5.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the __proto__ property to be edited.
Is GHSA-776f-qx25-q3cc in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected xml2js, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2023-0842
- Linkgithub.com/Leonidas-from-XIV/node-xml2js/issues/663
- Linkgithub.com/Leonidas-from-XIV/node-xml2js/pull/603/commits/581b19a62d88f8a3c068b5a45f4542c2d6a495a5
- Linkfluidattacks.com/advisories/myers
- Packagegithub.com/Leonidas-from-XIV/node-xml2js
- Linklists.debian.org/debian-lts-announce/2024/03/msg00013.html
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.