Skip to content

Product

npm xml2js vulnerabilities

1 published CVE affecting npm xml2js, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
1
Critical
0
High
0
Medium
1
Low
0
Unscored
0
CISA KEV
0

Latest npm xml2js CVEs

Newest publication first

  1. CVE-2023-0842 xml2js 0.4.23 - Prototype Pollution

    Published
    MediumCVSS 5.3 EPSS 1.4%

    xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the proto property to be edited.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.