Skip to content

[Security] Bump xml2js from 0.4.23 to 0.5.0

Dependabot requested to merge dependabot-npm_and_yarn-xml2js-0.5.0 into master

Bumps xml2js from 0.4.23 to 0.5.0. This update includes a security fix.

Vulnerabilities fixed

xml2js is vulnerable to prototype pollution xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the __proto__ property to be edited.

Patched versions: none Affected versions: <= 0.4.23

Commits

Dependabot commands
You can trigger Dependabot actions by commenting on this MR
  • $dependabot rebase will rebase this MR
  • $dependabot recreate will recreate this MR rewriting all the manual changes and resolving conflicts

Merge request reports