Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Informational severity, published 15 June 2023.

Which products and versions are affected?

fast-xml-parser (npm) SEMVER:introduced=4.2.4,fixed=4.2.5.

Is there a fix for This vulnerability?

Yes. fast-xml-parser (npm): upgrade to 4.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network.

Check whether you run fast-xml-parser (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

fast-xml-parser regex validation method improves safety

Severity: info · Published 2023-06-15

fast-xml-parser is a popular XML parsing library. A previous security patch that blocked regex injection attacks used a blacklist approach (checking for bad characters), which carries inherent risk of missing malicious characters. This advisory recommends a safer whitelist validation approach that verifies entity names match the XML specification, reducing future bypass risks.

Technologies: fast-xml-parser (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Informational severity, published 15 June 2023.
Which products and versions are affected?: fast-xml-parser (npm) SEMVER:introduced=4.2.4,fixed=4.2.5.
Is there a fix for This vulnerability?: Yes. fast-xml-parser (npm): upgrade to 4.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network.
Am I affected?: Check whether you run fast-xml-parser (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

fast-xml-parser (npm): upgrade to 4.2.5 or later
```
npm install fast-xml-parser@4.2.5
```

Technical details

This advisory comments on the patch for CVE-2023-34104 (a regex injection via DOCTYPE entities that caused DoS). The initial patch in v4.2.4 validated entity names by checking for the presence of a hardcoded blacklist of dangerous characters (!?\/[]$%{}^&*()<>|+). This blacklist approach is inherently fragile—it is easy to overlook characters that could be abused for regex injection. A safer approach, implemented in v4.2.5, validates against a whitelist derived from the XML 1.1 specification (checking that entity names match the Name production rule, starting with NameStartChar and followed by zero or more NameChar). This shifts from "reject known bad" to "accept only known good", significantly reducing the risk of future bypasses through forgotten blacklist entries.

Affected products

NaturalIntelligence fast-xml-parser 4.2.4

Timeline

2023-06-15: disclosed: Advisory GHSA-gpv5-7x3g-ghjv published commenting on patch adequacy
2023-06-13: patched: Version 4.2.5 released with improved whitelist-based validation

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.