CVE-2023-26920
published 2023-12-12CVE-2023-26920: fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution.
PriorityP335medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
1.15%
63.6th percentile
fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | node-webfont | — | — |
| naturalintelligence | fast-xml-parser | >= 0 < 4.1.2 | 4.1.2 |
| naturalintelligence | fast-xml-parser | >= 0 < 5.7.0 | 5.7.0 |
| naturalintelligence | fast_xml_parser | < 4.1.2 | 4.1.2 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
ghsa6.5MEDIUM
osv6.5MEDIUM
vendor_debian6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2023-26920: node-webfont - fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution.
vendor_debian·2023·CVSS 6.5
CVE-2023-26920 [MEDIUM] CVE-2023-26920: node-webfont - fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution.
fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution.
Scope: local
bookworm: undetermined
forky: undetermined
sid: undetermined
trixie: undetermined
GHSA
fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters
ghsa·2026-04-22·CVSS 6.5
CVE-2026-41650 [MEDIUM] CWE-91 fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters
fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters
# fast-xml-parser XMLBuilder: Comment and CDATA Injection via Unescaped Delimiters
## Summary
fast-xml-parser XMLBuilder does not escape the `-->` sequence in comment content or the `]]>` sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection when user-controlled data flows into comments or CDATA elements, leading to XSS, SOAP injection, or data manipulation.
Existing CVEs for fast-xml-parser cover different issues:
- CVE-2023-26920: Prototype pollution (parser)
- CVE-2023-34104: ReDoS (parser)
- CVE-2026-27942: Stack overflow in XMLBuilder with preserveOrder
- CVE-2026-25896: Entity encoding bypass via regex in DOCTYPE entities
This finding covers **unescaped
OSV
CVE-2023-26920: fast-xml-parser before 4
osv·2023-12-12·CVSS 6.5
CVE-2023-26920 [MEDIUM] CVE-2023-26920: fast-xml-parser before 4
fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution.
OSV
fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name
osv·2023-06-13
CVE-2023-26920 [MEDIUM] fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name
fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name
### Impact
As a part of this vulnerability, user was able to se code using `__proto__` as a tag or attribute name.
```js
const { XMLParser, XMLBuilder, XMLValidator} = require("fast-xml-parser");
let XMLdata = "hacked"
const parser = new XMLParser();
let jObj = parser.parse(XMLdata);
console.log(jObj.polluted) // should return hacked
```
### Patches
The problem has been patched in v4.1.2
### Workarounds
User can check for "__proto__" in the XML string before parsing it to the parser.
### References
https://gist.github.com/Sudistark/a5a45bd0804d522a1392cb5023aa7ef7
GHSA
fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name
ghsa·2023-06-13
CVE-2023-26920 [MEDIUM] CWE-1321 fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name
fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name
### Impact
As a part of this vulnerability, user was able to se code using `__proto__` as a tag or attribute name.
```js
const { XMLParser, XMLBuilder, XMLValidator} = require("fast-xml-parser");
let XMLdata = "hacked"
const parser = new XMLParser();
let jObj = parser.parse(XMLdata);
console.log(jObj.polluted) // should return hacked
```
### Patches
The problem has been patched in v4.1.2
### Workarounds
User can check for "__proto__" in the XML string before parsing it to the parser.
### References
https://gist.github.com/Sudistark/a5a45bd0804d522a1392cb5023aa7ef7
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gist.github.com/Sudistark/a5a45bd0804d522a1392cb5023aa7ef7https://github.com/NaturalIntelligence/fast-xml-parser/commit/2b032a4f799c63d83991e4f992f1c68e4dd05804https://github.com/advisories/GHSA-793h-6f7r-6qvmhttps://gist.github.com/Sudistark/a5a45bd0804d522a1392cb5023aa7ef7https://github.com/NaturalIntelligence/fast-xml-parser/commit/2b032a4f799c63d83991e4f992f1c68e4dd05804https://github.com/advisories/GHSA-793h-6f7r-6qvm
2023-12-12
Published