Skip to content
Log inStart free trial

GHSA-x3cc-x39p-42qx CVE-2021-26920 CVE-2023-26920 GHSA-793h-6f7r-6qvm

fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name

Medium Mavennpm
Severity
6.5 / 10
Medium · CVSS 3.1
Exploit chance (EPSS)
9.50%
Chance of exploitation in the next 30 days. Higher than 95.44% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Fix
Available
2 packages have a fixed version

Description

Impact

As a part of this vulnerability, user was able to se code using __proto__ as a tag or attribute name.

const { XMLParser, XMLBuilder, XMLValidator} = require("fast-xml-parser");

let XMLdata = "<__proto__><polluted>hacked</polluted></__proto__>"

const parser = new XMLParser();
let jObj = parser.parse(XMLdata);

console.log(jObj.polluted) // should return hacked

Patches

The problem has been patched in v4.1.2

Workarounds

User can check for "proto" in the XML string before parsing it to the parser.

References

https://gist.github.com/Sudistark/a5a45bd0804d522a1392cb5023aa7ef7

Affected versions

Maven

PackageVulnerableFixed in
org.apache.druid:druid-core
< 0.21.0
0.21.0

npm

PackageVulnerableFixed in
fast-xml-parser
< 4.1.2
4.1.2

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

org.apache.druid:druid-core Maven → 0.21.0

maven
<dependency><groupId>org.apache.druid</groupId><artifactId>druid-core</artifactId><version>0.21.0</version></dependency>
gradle
implementation("org.apache.druid:druid-core:0.21.0")

fast-xml-parser npm → 4.1.2

npm
npm install fast-xml-parser@4.1.2
yarn
yarn add fast-xml-parser@4.1.2
pnpm
pnpm add fast-xml-parser@4.1.2

Severity breakdown

CVSS 3.1 6.5

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Weakness

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

How to prevent it
  • Implementation: By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
  • Architecture and Design: By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
  • Implementation: When handling untrusted objects, validating using a schema can be used.
  • Implementation: By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
  • Implementation: Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-8r6m-32jq-jx6q
fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
High Also affects fast-xml-parser
GHSA-gh4j-gqv2-49f6
fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters
Medium Also affects fast-xml-parser
GHSA-jp2q-39xq-3w4g
Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser
Medium Also affects fast-xml-parser
GHSA-8gc5-j5rx-235r
fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)
High Also affects fast-xml-parser
GHSA-fj3w-jwp8-x2g3
fast-xml-parser has stack overflow in XMLBuilder with preserveOrder
Low Also affects fast-xml-parser
GHSA-m7jm-9gc2-mpf2
fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity names
Critical Also affects fast-xml-parser
GHSA-jmr7-xgp7-cmfj
fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)
High Also affects fast-xml-parser
GHSA-37qj-frw5-hhjh
fast-xml-parser has RangeError DoS Numeric Entities Bug
High Also affects fast-xml-parser
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor