xml2js is vulnerable to prototype pollution #291

New issue

Closed

opened 2023-05-02 18:02:50 +01:00 by Vylpes · 1 comment

Vylpes commented

2023-05-02 18:02:50 +01:00

Owner

Package: xml2js (npm)
Affected versions: < 0.5.0
Patched version: 0.5.0

xml2js versions before 0.5.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the proto property to be edited.

Package: xml2js (npm) Affected versions: < 0.5.0 Patched version: 0.5.0 --- xml2js versions before 0.5.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the __proto__ property to be edited.

Vylpes added the

type

dependencies

label 2023-05-02 18:02:55 +01:00

Vylpes added this to the 3.0.7 milestone 2023-05-02 18:02:57 +01:00

Vylpes commented

2023-05-02 18:03:08 +01:00

Author

Owner

typeorm@0.2.44 requires xml2js@^0.4.23

``` typeorm@0.2.44 requires xml2js@^0.4.23 ```

Vylpes started working 2023-05-08 17:35:39 +01:00

Vylpes stopped working 2023-05-08 18:19:31 +01:00

43 minutes 52 seconds

Vylpes closed this issue

2023-05-08 18:29:30 +01:00

No milestone

No project

No assignees

1 participant

Notifications

Total time spent: 43 minutes 52 seconds

Vylpes

43 minutes 52 seconds

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: RabbitLabs/vylbot-app#291

No description provided.