Description

fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution.

Remediation

References

https://gist.github.com/Sudistark/a5a45bd0804d522a1392cb5023aa7ef7

https://github.com/advisories/GHSA-793h-6f7r-6qvm

https://github.com/NaturalIntelligence/fast-xml-parser/commit/2b032a4f799c63d83991e4f992f1c68e4dd05804

Related Vulnerabilities

CVE-2020-7723 Vulnerability in npm package promisehelpers

CVE-2022-41935 Vulnerability in maven package org.xwiki.platform:xwiki-platform-livetable-ui

CVE-2022-25847 Vulnerability in npm package serve-lite

CVE-2023-4316 Vulnerability in maven package org.webjars.npm:zod

CVE-2021-25915 Vulnerability in npm package changeset

Severity

High

Classification

CWE-1321 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Exploit Third Party Advisory Patch