MediumGHSA-x3cc-x39p-42qxCVE-2021-26920CVE-2023-26920GHSA-793h-6f7r-6qvm

fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name

Published 13 Jun 2023 · Updated 8 Jul 2026

Affected package

fast-xml-parsernpm
Affected
<4.1.2
Fixed in
4.1.2
Update to the fixed version for your release line, for example:npm install fast-xml-parser@4.1.2

Details

Impact

As a part of this vulnerability, user was able to se code using __proto__ as a tag or attribute name.

const { XMLParser, XMLBuilder, XMLValidator} = require("fast-xml-parser");

let XMLdata = "<__proto__><polluted>hacked</polluted></__proto__>"

const parser = new XMLParser();
let jObj = parser.parse(XMLdata);

console.log(jObj.polluted) // should return hacked

Patches

The problem has been patched in v4.1.2

Workarounds

User can check for "__proto__" in the XML string before parsing it to the parser.

References

https://gist.github.com/Sudistark/a5a45bd0804d522a1392cb5023aa7ef7

Is GHSA-x3cc-x39p-42qx in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected fast-xml-parser, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.