fix(deps): update dependency fast-xml-parser to v4 [security] by renovate[bot] · Pull Request #327 · eclass/cev-providers

renovate · 2023-06-06T20:17:46Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
fast-xml-parser	`3.21.1` -> `4.1.2`

GitHub Vulnerability Alerts

CVE-2023-26920

Impact

As a part of this vulnerability, user was able to se code using __proto__ as a tag or attribute name.

const { XMLParser, XMLBuilder, XMLValidator} = require("fast-xml-parser");

let XMLdata = "<__proto__><polluted>hacked</polluted></__proto__>"

const parser = new XMLParser();
let jObj = parser.parse(XMLdata);

console.log(jObj.polluted) // should return hacked

Patches

The problem has been patched in v4.1.2

Workarounds

User can check for "proto" in the XML string before parsing it to the parser.

References

https://gist.github.com/Sudistark/a5a45bd0804d522a1392cb5023aa7ef7

Release Notes

NaturalIntelligence/fast-xml-parser (fast-xml-parser)

Generating different combined, parser only, builder only, validator only browser bundles
Keeping cjs modules as they can be imported in cjs and esm modules both. Otherwise refer esm branch.

4.0.0-beta.8 / 2021-12-13

call tagValueProcessor for stop nodes

4.0.0-beta.7 / 2021-12-09

fix Validator bug when an attribute has no value but '=' only
XML Builder should suppress unpaired tags by default.
documents update for missing features
refactoring to use Object.assign
refactoring to remove repeated code

4.0.0-beta.6 / 2021-12-05

Support PI Tags processing
Support suppressBooleanAttributes by XML Builder for attributes with value true.

4.0.0-beta.5 / 2021-12-04

fix: when a tag with name "attributes"

4.0.0-beta.4 / 2021-12-02

Support HTML document parsing
skip stop nodes parsing when building the XML from JS object
Support external entites without DOCTYPE
update dev dependency: strnum v1.0.5 to fix long number issue

4.0.0-beta.3 / 2021-11-30

support global stopNodes expression like "*.stop"
support self-closing and paired unpaired tags
fix: CDATA should not be parsed.
Fix typings for XMLBuilder (#396)(By Anders Emil Salvesen)
supports XML entities, HTML entities, DOCTYPE entities

⚠️ 4.0.0-beta.2 / 2021-11-19

rename attrMap to attibutes in parser output when preserveOrder:true
supports unpairedTags

⚠️ 4.0.0-beta.1 / 2021-11-18

Parser returns an array now
- to make the structure common
- and to return root level detail
renamed cdataTagName to cdataPropName
Added commentPropName
fix typings

⚠️ 4.0.0-beta.0 / 2021-11-16

Name change of many configuration properties.
- attrNodeName to attributesGroupName
- attrValueProcessor to attributeValueProcessor
- parseNodeValue to parseTagValue
- ignoreNameSpace to removeNSPrefix
- numParseOptions to numberParseOptions
- spelling correction for suppressEmptyNode
Name change of cli and browser bundle to fxparser
isArray option is added to parse a tag into array
preserveOrder option is added to render XML in such a way that the result js Object maintains the order of properties same as in XML.
Processing behaviour of tagValueProcessor and attributeValueProcessor are changes with extra input parameters
j2xparser is renamed to XMLBuilder.
You need to build XML parser instance for given options first before parsing XML.
fix #327, #336: throw error when extra text after XML content
fix #330: attribute value can have '\n',
fix #350: attributes can be separated by '\n' from tagname

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

commit-lint · 2023-06-06T20:17:50Z

Bug Fixes

deps: update dependency fast-xml-parser to v4 [security] (b4f7923)

Contributors

renovate[bot]

Commit-Lint commands

You can trigger Commit-Lint actions by commenting on this PR:

@Commit-Lint merge patch will merge dependabot PR on "patch" versions (X.X.Y - Y change)
@Commit-Lint merge minor will merge dependabot PR on "minor" versions (X.Y.Y - Y change)
@Commit-Lint merge major will merge dependabot PR on "major" versions (Y.Y.Y - Y change)
@Commit-Lint merge disable will desactivate merge dependabot PR
@Commit-Lint review will approve dependabot PR
@Commit-Lint stop review will stop approve dependabot PR

[skip ci]

renovate · 2025-07-09T21:35:59Z

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 4.x releases. But if you manually upgrade to 4.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

renovate bot added the renovate label Jun 6, 2023

renovate bot force-pushed the renovate/npm-fast-xml-parser-vulnerability branch from b4f7923 to 52e56f7 Compare January 22, 2024 18:49

renovate bot force-pushed the renovate/npm-fast-xml-parser-vulnerability branch from 52e56f7 to e4a8b75 Compare July 29, 2024 22:54

fix(deps): update dependency fast-xml-parser to v4 [security]

ea2fefc

[skip ci]

renovate bot force-pushed the renovate/npm-fast-xml-parser-vulnerability branch from e4a8b75 to ea2fefc Compare October 11, 2024 17:01

SeGonzalezR closed this Jul 9, 2025

renovate bot deleted the renovate/npm-fast-xml-parser-vulnerability branch July 9, 2025 21:36

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update dependency fast-xml-parser to v4 [security]#327

fix(deps): update dependency fast-xml-parser to v4 [security]#327
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-fast-xml-parser-vulnerability

renovate bot commented Jun 6, 2023 •

edited

Loading

Uh oh!

commit-lint bot commented Jun 6, 2023

Uh oh!

renovate bot commented Jul 9, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate bot commented Jun 6, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

GitHub Vulnerability Alerts

Impact

Patches

Workarounds

References

Release Notes

v4.0.0: v4

Configuration

Uh oh!

commit-lint bot commented Jun 6, 2023

Bug Fixes

Contributors

Uh oh!

renovate bot commented Jul 9, 2025

Renovate Ignore Notification

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate bot commented Jun 6, 2023 •

edited

Loading

`v4.0.0`: v4