{"action":"Upgrade fast-xml-parser to 4.1.2 or later.","affected":[{"fixed":"4.1.2","introduced":"0"}],"component":"fast-xml-parser","cve_ids":["CVE-2021-26920","CVE-2023-26920"],"ecosystem":"npm","epss":0.09498,"exploited":false,"fixed_versions":["4.1.2"],"ghsa_id":"GHSA-x3cc-x39p-42qx","id":"tcs_01M5KGGNFZXNFFPEWNKTNHAJQ5","modified_at":"2026-07-08T06:49:36.622686398Z","published_at":"2023-06-13T12:44:34Z","references":["https://osv.dev/vulnerability/GHSA-x3cc-x39p-42qx","https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-x3cc-x39p-42qx","https://nvd.nist.gov/vuln/detail/CVE-2023-26920","https://github.com/NaturalIntelligence/fast-xml-parser/commit/2b032a4f799c63d83991e4f992f1c68e4dd05804","https://gist.github.com/Sudistark/a5a45bd0804d522a1392cb5023aa7ef7","https://github.com/NaturalIntelligence/fast-xml-parser","https://github.com/advisories/GHSA-793h-6f7r-6qvm"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-x3cc-x39p-42qx","url":"https://osv.dev/vulnerability/GHSA-x3cc-x39p-42qx"}],"summary":"fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name"}