search

Leonidas-from-XIV / node-xml2js

XML to JavaScript object converter.
MIT License
4.84k stars 596 forks source link

Received a security issue: Published Vulnerabilities CVE-2023-0842 suppress xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the proto property to be edited. #669

Closed WormGirl closed 1 year ago

WormGirl commented 1 year ago

https://nvd.nist.gov/vuln/detail/CVE-2023-0842#match-9072644

Leonidas-from-XIV commented 1 year ago

Closing as duplicate, fixed version has been released.