xml2js 0.4.23 - Prototype Pollution
Priority MEDIUM 63CWE-1321Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 12 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.
Summary
xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the __proto__ property to be edited.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01392 72nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial xml2js (npm): 0.5.0Red Hat: 12 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | xml2js | 0.4.23 | — | No fix listed | CNA |
| — | xml2js (npm) | before 0.5.0 | 0.5.0 | Patch available | GHSA-776f-qx25-q3cc |
- xml2js Vendor— Affected 0.4.23 Fixed in — No fix listed CNA
- xml2js (npm) Vendor— Affected before 0.5.0 Fixed in 0.5.0 Patch available GHSA-776f-qx25-q3cc
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:xml2js_project:xml2js:0.4.23:*:*:*:*:*:*:* | 0.4.23 | Vulnerable | Xml2js Project |
- cpe:2.3:a:xml2js_project:xml2js:0.4.23:*:*:*:*:*:*:* Versions 0.4.23 Vulnerable ·Xml2js Project
Remediation
- Fix · GHSA-776f-qx25-q3cc xml2js (npm) Fixed in 0.5.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Service Mesh 2 | Affected | No fix planned: Will not fix |
| OpenShift Service Mesh 2.1 | Affected | No fix planned: Will not fix |
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix yet |
| Red Hat OpenShift Dev Spaces | Affected | No fix planned: Will not fix |
| Red Hat Openshift Container Storage 4 | Affected | No fix planned: Out of support scope |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
Not affected: 4 products
- Red Hat A-MQ Online
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2023-0842
- 2026-10-03 Alias added: GHSA-776f-qx25-q3cc
References
Other 6
- https://github.com/Leonidas-from-XIV/node-xml2js/
- [debian-lts-announce] 20240314 [SECURITY] [DLA 3760-1] node-xml2js security update
- https://github.com/Leonidas-from-XIV/node-xml2js/issues/663
- https://github.com/Leonidas-from-XIV/node-xml2js/pull/603/commits/581b19a62d88f8a3c068b5a45f4542c2d6a495a5
- https://fluidattacks.com/advisories/myers
- https://github.com/Leonidas-from-XIV/node-xml2js
Sources
- CVE-2023-0842 · CVE Program
- CVE-2023-0842 · NVD
- FIRST EPSS
- GHSA-776f-qx25-q3cc · GitHub Advisory Database · CC BY 4.0
- CVE-2023-0842 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences