| Package | Affected versions | Patched versions |
|---|---|---|
| fast-xml-parser | ≥ 5.0.0, < 5.3.8< 4.5.4 | 5.3.84.5.4 |
| fast-xml-parser | ≥ 4.0.0-beta.0, < 4.5.4≥ 5.0.0, < 5.3.8 | 4.5.45.3.8 |
Application crashes with stack overflow when user use XML builder with prserveOrder:true for following or similar input
[{
'foo': [
{ 'bar': [{ '@_V': 'baz' }] }
]
}]
Cause: arrToStr was not validating if the input is an array or a string and treating all non-array values as text content.
What kind of vulnerability is it? Who is impacted?
Yes in 5.3.8
Use XML builder with preserveOrder:false or check the input data before passing to builder.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free