{"id":"CVE-2023-26920","published":"2023-12-12T00:00:00Z","modified":"2024-08-02T12:01:31Z","title":"fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution","vendor":null,"product":null,"tier":"tail","description":{"text":"fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01152,"percentile":0.66827,"provenance":"source"},"cwes":[],"references":[{"url":"https://gist.github.com/Sudistark/a5a45bd0804d522a1392cb5023aa7ef7","tags":[]},{"url":"https://github.com/advisories/GHSA-793h-6f7r-6qvm","tags":[]},{"url":"https://github.com/NaturalIntelligence/fast-xml-parser/commit/2b032a4f799c63d83991e4f992f1c68e4dd05804","tags":[]}],"priority":{"score":13.4,"factors":[{"name":"EPSS percentile","points":13.37}]},"affected":[{"ecosystem":"npm","package":"fast-xml-parser","vulnerableRanges":["<4.1.2"],"patched":["4.1.2"],"from":["GHSA-x3cc-x39p-42qx"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-1910","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-apache-druid-cve-2021-26920","parents":[{"from":"CVE-2021-26920","to":"CVE-2023-26920","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-x3cc-x39p-42qx","via":"reference","url":"https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-x3cc-x39p-42qx"}]},{"from":"CVE-2021-36749","to":"CVE-2023-26920","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-9p5g-vg43-mj5r","via":"reference","url":"https://github.com/advisories/GHSA-793h-6f7r-6qvm"}]}]}}