Threat database

CVE-2023-0842 is a medium severity prototype pollution vulnerability in xml2js version 0.4.23. It allows an unauthenticated remote attacker to modify or add properties to JavaScript objects by exploiting improper validation of JSON keys, specifically the __proto__ property. This can lead to integrity issues in applications using the vulnerable xml2js version, potentially causing unexpected behavior or security bypasses. The vulnerability does not impact confidentiality or availability directly and requires no user interaction. No known exploits are currently reported in the wild. European organizations using xml2js 0.4.23 in their Node.