xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection

Description

This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into xhr.send could result in arbitrary code being injected and run.

Recommendation

Update the xmlhttprequest-ssl package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.6.2
• Patched version(s): 1.6.2

References

• GHSA-h4j5-c7cj-74xg
• snyk.io
• CVE-2020-28502
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• xmlhttprequest and xmlhttprequest-ssl vulnerable to Arbitrary Code Injection (GHSA-h4j5-c7cj-74xg) - CVE-2020-28502
• @siteboon/claude-code-ui is Vulnerable to Shell Command Injection in Git Routes - CVE-2026-31861
• Code Injection in mquery - CVE-2020-35149
• @siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection - CVE-2026-31975

Tags:

npm

xmlhttprequest-ssl