npm/xml2js CVE-2023-0842: medium 5.3, EPSS 1.40%
xml2js is vulnerable to prototype pollution
Action: Upgrade xml2js to 0.5.0 or later.
npm i xml2js@0.5.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.5.0 | - |
Fixed versions
| 0.5.0 |
Sources
- osv: GHSA-776f-qx25-q3cc
- https://nvd.nist.gov/vuln/detail/CVE-2023-0842
- https://github.com/Leonidas-from-XIV/node-xml2js/issues/663
- https://github.com/Leonidas-from-XIV/node-xml2js/pull/603/commits/581b19a62d88f8a3c068b5a45f4542c2d6a495a5
- https://fluidattacks.com/advisories/myers
- https://github.com/Leonidas-from-XIV/node-xml2js
- https://lists.debian.org/debian-lts-announce/2024/03/msg00013.html
CVE-2023-0842 · published · modified · JSON