PT-2023-33020 · Npm · Fast-Xml-Parser

Published 2023-06-15 · Updated 2023-06-15

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions fast-xml-parser (affected versions not specified)

Description The issue concerns the validation of entity names in the fast-xml-parser code. The current approach checks for the presence of invalid characters, which can be risky as it may not cover all possible invalid characters. A safer method would be to validate entity names against the XML specification, which defines a Name as a NameStartChar followed by zero or more NameChar. The NameStartChar and NameChar are defined by specific Unicode character ranges. To improve validation, a regular expression can be built to represent this definition and check if the given name matches.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GHSA-GPV5-7X3G-GHJV

Affected Products

Fast-Xml-Parser

References · 5

• https://osv.dev/vulnerability/GHSA-gpv5-7x3g-ghjv · Vendor Advisory
• https://github.com/NaturalIntelligence/fast-xml-parser · Note
• https://github.com/NaturalIntelligence/fast-xml-parser/commit/9a880b887916855c3a510869fd1ee268d7fe58b1 · Note
• https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-6w63-h3fj-q4vw · Note
• https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-gpv5-7x3g-ghjv · Note