Description

fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution.

Remediation

References

https://gist.github.com/Sudistark/a5a45bd0804d522a1392cb5023aa7ef7

https://github.com/advisories/GHSA-793h-6f7r-6qvm

https://github.com/NaturalIntelligence/fast-xml-parser/commit/2b032a4f799c63d83991e4f992f1c68e4dd05804

Related Vulnerabilities

CVE-2023-43794 Vulnerability in npm package nocodb

CVE-2022-21670 Vulnerability in npm package markdown-it

CVE-2020-28282 Vulnerability in npm package getobject

CVE-2022-39381 Vulnerability in npm package muhammara

CVE-2021-32859 Vulnerability in npm package baremetrics-calendar

Severity

High

Classification

CWE-1321 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Exploit Third Party Advisory Patch