Source: node-xml2js Version: 0.4.23+~cs15.4.0+dfsg-4 Severity: important Tags: security upstream Forwarded: https://github.com/Leonidas-from-XIV/node-xml2js/issues/663 X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org>
Hi, The following vulnerability was published for node-xml2js. CVE-2023-0842[0]: | xml2js version 0.4.23 allows an external attacker to edit or add new | properties to an object. This is possible because the application does | not properly validate incoming JSON keys, thus allowing the __proto__ | property to be edited. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2023-0842 https://www.cve.org/CVERecord?id=CVE-2023-0842 [1] https://github.com/Leonidas-from-XIV/node-xml2js/issues/663 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
