Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS03NzZmLXF4MjUtcTNjY84AAykj
xml2js is vulnerable to prototype pollution
xml2js versions before 0.5.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the __proto__ property to be edited.
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03NzZmLXF4MjUtcTNjY84AAykj
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 1 year ago
Updated: 2 months ago
CVSS Score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Identifiers: GHSA-776f-qx25-q3cc, CVE-2023-0842
References:
- https://nvd.nist.gov/vuln/detail/CVE-2023-0842
- https://github.com/Leonidas-from-XIV/node-xml2js/issues/663
- https://github.com/Leonidas-from-XIV/node-xml2js/pull/603/commits/581b19a62d88f8a3c068b5a45f4542c2d6a495a5
- https://fluidattacks.com/advisories/myers
- https://github.com/Leonidas-from-XIV/node-xml2js
- https://lists.debian.org/debian-lts-announce/2024/03/msg00013.html
- https://github.com/advisories/GHSA-776f-qx25-q3cc
Blast Radius: 31.9
Affected Packages
npm:xml2js
Dependent packages: 8,930Dependent repositories: 1,065,103
Downloads: 86,212,784 last month
Affected Version Ranges: < 0.5.0
Fixed in: 0.5.0
All affected versions: 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4, 0.1.5, 0.1.6, 0.1.7, 0.1.8, 0.1.9, 0.1.10, 0.1.11, 0.1.12, 0.1.13, 0.1.14, 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.2.5, 0.2.6, 0.2.7, 0.2.8, 0.4.0, 0.4.1, 0.4.2, 0.4.3, 0.4.4, 0.4.5, 0.4.6, 0.4.7, 0.4.8, 0.4.9, 0.4.10, 0.4.11, 0.4.12, 0.4.13, 0.4.15, 0.4.16, 0.4.17, 0.4.18, 0.4.19, 0.4.20, 0.4.21, 0.4.22, 0.4.23
All unaffected versions: 0.5.0, 0.6.0, 0.6.1, 0.6.2