Home > Vulnerability Database > CVE-2023-26920

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2023-26920

Good to know:

Date: December 11, 2023

fast-xml-parser before 4.1.2 allows proto for Prototype Pollution.

Language: JS

Severity Score

6.5

Related Resources (7)

Url: https://github.com/advisories/GHSA-793h-6f7r-6qvm

Url: https://gist.github.com/Sudistark/a5a45bd0804d522a1392cb5023aa7ef7

Url: https://nvd.nist.gov/vuln/detail/CVE-2023-26920

Url: https://github.com/NaturalIntelligence/fast-xml-parser/commit/2b032a4f799c63d83991e4f992f1c68e4dd05804

Url: https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-x3cc-x39p-42qx

Url: https://github.com/NaturalIntelligence/fast-xml-parser

Url: https://www.mend.io/vulnerability-database/CVE-2023-26920

Severity Score

6.5

Weakness Type (CWE)

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CWE-1321

Top Fix

Upgrade Version

Upgrade to version fast-xml-parser - 4.1.2;fast-xml-parser - 4.1.2;org.webjars.npm:fast-xml-parser:4.1.2

CVSS v3.1

Base Score:	6.5
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	LOW
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	NONE
Availability (A):	NONE

Do you need more information?

Contact Us