CVE-2023-0842 xml2js 0.4.23 - Prototype Pollution
An attacker can modify object properties via prototype pollution in the xml2js library by sending crafted JSON keys.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-0842?
CVE-2023-0842 is a medium-severity vulnerability in xml2js, published on 5 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the __proto__ property to be edited.
Weakness: CWE-1321
Which versions are affected by CVE-2023-0842?
2 open source packages ship an affected version, including xml2js. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
xml2js npm | All versions | 0.5.0 |
xml2js npm | All versions | 0.5.0 |
Products include Xml2js Project Xml2js.
How do I fix CVE-2023-0842?
Upgrade xml2js to 0.5.0 or later.
Is CVE-2023-0842 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-0842 exists.
Sources
Also known as CLSA-2026-1773879452, CLSA-2026-1773879453, CLSA-2026-1773879454, CLSA-2026-1777336771, DEBIAN-CVE-2023-0842, DLA-3760-1 and 4 more.