CODEWITHSUNDEEP
pythonsecurityaws-sdkxml2js
Keerthan Mjr
Keerthan Mjr

Reputation: 91

xml2js is vulnerable to prototype pollution

xml2js <=0.4.23 Severity: high xml2js is vulnerable to prototype pollution - https://github.com/advisories/GHSA-776f-qx25-q3cc No fix available node_modules/xml2js aws-sdk * Depends on vulnerable versions of xml2js node_modules/aws-sdk

2 high severity vulnerabilities

Upgraded aws-sdk npm package to latest version. But vulnerability still exists.

Upvotes: 8

Views: 6296

Answers (3)

Mudassir Rafiq
Mudassir Rafiq

Reputation: 51

Given answers work well for hiding the error but you will face errors while making a development build or apk of the app. Following steps helped me solve the issue:

  1. Search for xml2js in package-lock.json file

  2. You will find xml2js version like this

    "xml2js" : "0.4.23"

You need to replace 0.4.23 by 0.5.0

`"xml2js" : "0.5.0"`
  1. Run npm install

This will resolve the error.

Upvotes: 3

Mahmoud ElGharably
Mahmoud ElGharably

Reputation: 11

This solution worked for me

  1. delete package-lock.json

  2. delete node modules

  3. npm i xml2js

  4. add this to my package.json:

    "overrides": {
  "xml2js": "^0.5.0"   }

  5. npm i

Upvotes: 0

AlexUA
AlexUA

Reputation: 747

  1. delete your package-lock.json,
  2. add this to your package.json:
 "overrides": {
   "xml2js": "^0.5.0"
 }
  1. reinstall the deps : npm i

Upvotes: 16

Related Questions