CVE-2023-0842: Prototype Pollution in xml2js
Summary
CVE-2023-0842: xml2js is vulnerable to prototype pollution. Affects xml2js versions < 0.5.0. Fixed in 0.5.0. How to fix ↓
Also tracked for
- node-xml2js · Debian:11
The same CVE-2023-0842 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
xml2js is an npm package used for parsing XML data into JavaScript objects. It is commonly used in web applications to handle XML-based APIs or data sources. The package allows developers to convert XML data into a structured format, making it easier to work with in JavaScript. However, versions before 0.5.0 of xml2js are vulnerable to prototype pollution.
Vulnerability Detail
The vulnerability in xml2js arises from improper validation of incoming JSON keys. This allows an external attacker to modify or add new properties to an object, including the __proto__ property. By manipulating the __proto__ property, an attacker can potentially modify the behavior of the affected application, leading to various security issues. The severity of this vulnerability is considered moderate with a CVSS score of 5.3.
How To Fix
Latest published version: 0.6.2 as of 22 Oct 2026
npm install xml2js@0.6.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.0
This is the first release that contains the fix.
npm install xml2js@0.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is to sanitize and validate incoming JSON keys manually. This can be done by checking each key for unwanted properties, such as __proto__, before processing the data. Here's an example of how to sanitize JSON keys in JavaScript:
const sanitizeJSONKeys = (data) => {
if (typeof data === 'object' && data !== null) {
for (const key in data) {
if (key === '__proto__') {
delete data[key];
}
else if (typeof data[key] === 'object') {
sanitizeJSONKeys(data[key]);
}
}
}
return data;
}
Conclusion
In conclusion, xml2js versions before 0.5.0 are vulnerable to prototype pollution. This can allow an attacker to modify or add properties to objects, potentially leading to security issues. It is recommended to update xml2js to version 0.5.0 or later to fix this vulnerability. If immediate update is not possible, developers should manually sanitize and validate incoming JSON keys to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for xml2js →
FAQ
xml2js is an npm package used for parsing XML data into JavaScript objects. It simplifies working with XML-based APIs or data sources in web applications.
Prototype pollution is a vulnerability that allows an attacker to modify or add properties to an object's prototype. This can lead to unexpected behavior and security issues in applications.
The vulnerability in xml2js allows an attacker to modify or add properties to objects, potentially altering the behavior of the affected application. This can lead to security vulnerabilities or unexpected application behavior.
The severity of this vulnerability is considered moderate with a CVSS score of 5.3.
To fix this vulnerability, update xml2js to version 0.5.0 or later. Alternatively, sanitize and validate incoming JSON keys manually to prevent prototype pollution attacks.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
