body-parser-xml vulnerable to Prototype Pollution

CRITICO 9.8CVE-2021-3666 · GHSA-2ghc-6v89-pw9j · Published 13/09/2021 · updated 17/06/2026

In breve

CVE-2021-3666 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda xml body parser (xml body parser project), body-parser-xml.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.3%, superiore al 70.6% delle vulnerabilità.
Correzione: aggiornare a 2.0.3 o successiva.

Package	Affected versions	Patched versions
xml body parser xml_body_parser_project	`< 2.0.3`	`2.0.3`
body-parser-xml npm	`< 2.0.3`	`2.0.3`

body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').

NVD description

body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Running one of these products? Scan your site to see whether it exposes a vulnerable version.