Executive brief
xml2js is a popular Node.js library used to convert XML data into JavaScript objects. A vulnerability allows attackers to inject code by manipulating the __proto__ property during XML-to-JSON conversion, potentially modifying the behavior of affected applications or exposing sensitive data.
Technical details
xml2js versions before 0.5.0 are vulnerable to prototype pollution (CWE-1321) due to insufficient validation of JSON keys during XML parsing. An attacker can craft malicious XML input containing __proto__ properties to pollute the prototype chain of JavaScript objects. The vulnerability requires no authentication and is remotely exploitable via network, affecting any application that parses untrusted XML input using the vulnerable library. An attacker can edit or add properties to objects in memory, potentially leading to application behavior modification or information disclosure. The fix is available in version 0.5.0 and later.
Affected products
- Leonidas-from-XIV xml2js before 0.5.0
Timeline
- 2023-04-05: disclosed
- 2023: patched: Fix released in version 0.5.0