Skip to content

Product

debian/node-xml2js vulnerabilities

2 published CVES affecting debian/node-xml2js, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
0
Medium
1
Low
0
Unscored
1
CISA KEV
0

Latest debian/node-xml2js CVEs

Newest publication first

  2. CVE-2023-0842 xml2js 0.4.23 - Prototype Pollution

    Published
    MediumCVSS 5.3 EPSS 1.4%

    xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the proto property to be edited.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.