fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name

Description

As a part of this vulnerability, user was able to se code using __proto__ as a tag or attribute name.

Recommendation

Update the fast-xml-parser package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.1.2
• Patched version(s): 4.1.2

References

• GHSA-x3cc-x39p-42qx
• CVE-2023-26920
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Mermaid does not properly sanitize architecture diagram iconText leading to XSS - CVE-2025-54880
• create-choo-app3 is vulnerable to Command Injection via the devInstall function - CVE-2022-25855
• Vue I18n Allows Prototype Pollution in `handleFlatJson` (GHSA-p2ph-7g93-hw3m) 5 - CVE-2025-27597
• Vue I18n Allows Prototype Pollution in `handleFlatJson` (GHSA-p2ph-7g93-hw3m) 4 - CVE-2025-27597

Tags:

npm

fast-xml-parser