GHSA-X3CC-X39P-42QX fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name

🗓️ 13 Jun 2023 12:44:34Reported by GoogleType

osv🔗 osv.dev👁 1 Views

Prototype pollution in fast-xml-parser via __proto__ tag; fixed in version four one two; workaround: check for __proto__.

Reporter	Title	Published	Views	Family All 44
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring, IntegrationServer and IntegrationRuntime operands are vulnerable to arbitrary code execution due to [CVE-2023-26920]	28 Jun 202315:06	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOps	26 Mar 202503:48	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data is vulnerable to Prototype Pollution due to fast-xml-parser ( CVE-2023-26920 )	5 Jun 202506:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar User Behavior Analytics is vulnerable to components with known vulnerabilities	31 Aug 202310:37	–	ibm
ATTACKERKB	CVE-2023-26920	12 Dec 202317:15	–	attackerkb
Tenable Nessus	Apache Druid < 0.21.0 Privilege Escalation	20 Sep 202300:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2023-26920	21 Feb 202600:00	–	nessus
BDU FSTEC	The vulnerability of the Apache Druid analytical database, related to deficiencies in authentication mechanisms, allows attackers to gain unauthorized access to protected information.	15 Sep 202100:00	–	bdu_fstec
Circl	CVE-2021-26920	2 Jul 202112:31	–	circl
CNNVD	Apache Druid权限许可和访问控制问题漏洞	2 Jul 202100:00	–	cnnvd

Source	Link
github	www.github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-x3cc-x39p-42qx
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-26920
github	www.github.com/NaturalIntelligence/fast-xml-parser/commit/2b032a4f799c63d83991e4f992f1c68e4dd05804
gist	www.gist.github.com/Sudistark/a5a45bd0804d522a1392cb5023aa7ef7
github	www.github.com/NaturalIntelligence/fast-xml-parser
github	www.github.com/advisories/GHSA-793h-6f7r-6qvm

08 Jul 2026 06:49Current

7High risk

Vulners AI Score7

CVSS 3.16.5

EPSS0.09877