Description

fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution.

Remediation

References

https://gist.github.com/Sudistark/a5a45bd0804d522a1392cb5023aa7ef7

https://github.com/advisories/GHSA-793h-6f7r-6qvm

https://github.com/NaturalIntelligence/fast-xml-parser/commit/2b032a4f799c63d83991e4f992f1c68e4dd05804

Related Vulnerabilities

CVE-2023-22580 Vulnerability in npm package sequelize

CVE-2022-36917 Vulnerability in maven package org.jenkins-ci.plugins:google-cloud-backup

CVE-2018-9206 Vulnerability in npm package blueimp-file-upload

CVE-2023-3431 Vulnerability in maven package net.sourceforge.plantuml:plantuml

CVE-2022-24773 Vulnerability in npm package node-forge

Severity

High

Classification

CWE-1321 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Exploit Third Party Advisory Patch