-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from using {} (which inherits from Object.prototype) instead of Object.create(null) when creating parsed objects. The commit 581b19a explicitly addresses this by replacing all {} initializations with Object.create(null) in the parser's element/attribute/child object creation paths. These functions handled raw XML input without prototype validation, making them entry points for __proto__ injection in vulnerable versions (<0.5.0).
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| xml2js | npm | < 0.5.0 | 0.5.0 |
JavaScriptJavaScriptOngoing coverage of React2Shell