CVE-2023-0842
xml2js 0.4.23 - Prototype Pollution
xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the proto property to be edited.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the proto property to be edited.
- Record
CVE-2023-0842- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-1321
- Updated
- 2026-11-02
CVE List
xml2js 0.4.23 - Prototype Pollution
xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the proto property to be edited.
- Record
CVE-2023-0842- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-1321
- Updated
- 2026-11-02
EUVDEUVD-2023-1222
xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the proto property to be edited.
- Record
EUVD-2023-1222- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-776f-qx25-q3cc
xml2js is vulnerable to prototype pollution
xml2js versions before 0.5.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the __proto__ property to be edited.
- Record
GHSA-776f-qx25-q3cc- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-1321
- Updated
- 2026-11-02
OSV
xml2js 0.4.23 - Prototype Pollution
xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the proto property to be edited.
- Record
CVE-2023-0842- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-0842
xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the proto property to be edited.
- Record
DEBIAN-CVE-2023-0842- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-776f-qx25-q3cc
xml2js is vulnerable to prototype pollution
xml2js versions before 0.5.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the __proto__ property to be edited.
- Record
GHSA-776f-qx25-q3cc- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-1321
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-0842
xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the proto property to be edited.
- Record
UBUNTU-CVE-2023-0842- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1773879452 No score
TuxCare security update for xml2js (1 CVE)
TuxCare rebuilt xml2js to address 1 CVE. Fixed in 0.4.23-tuxcare.1.
- Record
CLSA-2026-1773879452- Updated
- 2026-11-02
OSVCLSA-2026-1773879453 No score
TuxCare security update for xml2js (1 CVE)
TuxCare rebuilt xml2js to address 1 CVE. Fixed in 0.2.8-tuxcare.1.
- Record
CLSA-2026-1773879453- Updated
- 2026-11-02
OSVCLSA-2026-1773879454 No score
TuxCare security update for xml2js (1 CVE)
TuxCare rebuilt xml2js to address 1 CVE. Fixed in 0.2.6-tuxcare.1.
- Record
CLSA-2026-1773879454- Updated
- 2026-11-02
OSVCLSA-2026-1777336771 No score
TuxCare security update for xml2js (1 CVE)
TuxCare rebuilt xml2js to address 1 CVE. Fixed in 0.4.4-tuxcare.1.
- Record
CLSA-2026-1777336771- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xml2jsnpm |
before 0.5.0 | 0.5.0 |
xml2jsTuxCare:npm |
0.4.23-tuxcare.0 up to 0.4.23-tuxcare.1, plus listed versions 0.4.23 |
0.4.23-tuxcare.1 |
xml2jsTuxCare:npm |
0.2.8-tuxcare.0 up to 0.2.8-tuxcare.1, plus listed versions 0.2.8 |
0.2.8-tuxcare.1 |
xml2jsTuxCare:npm |
0.2.6-tuxcare.0 up to 0.2.6-tuxcare.1, plus listed versions 0.2.6 |
0.2.6-tuxcare.1 |
xml2jsTuxCare:npm |
0.4.4-tuxcare.0 up to 0.4.4-tuxcare.1, plus listed versions 0.4.4 |
0.4.4-tuxcare.1 |
node-xml2jsDebian:12 |
before 0.4.23+~cs15.4.0+dfsg-7 | 0.4.23+~cs15.4.0+dfsg-7 |
node-xml2jsDebian:13 |
before 0.4.23+~cs15.4.0+dfsg-7 | 0.4.23+~cs15.4.0+dfsg-7 |
node-xml2jsDebian:14 |
before 0.4.23+~cs15.4.0+dfsg-7 | 0.4.23+~cs15.4.0+dfsg-7 |
node-xml2jsDebian:10 |
before 0.2.8-1.1+deb11u1~deb10u1, plus listed versions 0.2.8-10.2.8-1.1 |
0.2.8-1.1+deb11u1~deb10u1 |
node-xml2jsUbuntu:16.04:LTS |
All versions, plus listed versions 0.2.8-1 |
None known |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
node-xml2jsUbuntu:18.04:LTS |
All versions, plus listed versions 0.2.8-1 |
None known |
node-xml2jsUbuntu:20.04:LTS |
All versions, plus listed versions 0.2.8-1 |
None known |
node-xml2jsUbuntu:22.04:LTS |
All versions, plus listed versions 0.2.8-1.10.4.23+~cs15.4.0+dfsg-2 |
None known |
node-xml2jsUbuntu:24.04:LTS |
All versions, plus listed versions 0.6.2+~cs15.1.1-1 |
None known |
node-xml2jsUbuntu:25.10 |
All versions, plus listed versions 0.6.2+~cs15.1.1-1 |
None known |
node-xml2jsUbuntu:26.10 |
All versions, plus listed versions 0.6.2+~cs15.1.1-1 |
None known |
node-xml2jsUbuntu:26.04:LTS |
All versions, plus listed versions 0.6.2+~cs15.1.1-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-0842 is a medium vulnerability (CVSS 5.3) in Xml2js Project Xml2js, published April 5, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.39%, the 72nd percentile. Fixed in xml2js 0.5.0.
References
fluidattacks.com/advisories/myers
github.com/Leonidas-from-XIV/node-xml2js
lists.debian.org/debian-lts-announce/2024/03/msg00013.html
nvd.nist.gov/vuln/detail/CVE-2023-0842
Show 7 moreShow less
registry.npmjs.org
security-tracker.debian.org/tracker/CVE-2023-0842
ubuntu.com/security/CVE-2023-0842
cve.org/CVERecord?id=CVE-2023-0842