CVE-2023-26920

6.5 mediumEPSS 1.2%

Medium (6.5) in naturalintelligence fast xml parser. EPSS 1.2% chance of exploitation in the next 30 days. Fixed in org.apache.druid:druid-core 0.21.0.

fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 66% of CVEs (scores of 2026-10-31)
CWE: CWE-1321
Published: 2023-12-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

naturalintelligence:fast_xml_parser

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-793h-6f7r-6qvm	Maven	org.apache.druid:druid-core	<0.21.0	0.21.0
GHSA-x3cc-x39p-42qx	npm	fast-xml-parser	<4.1.2	4.1.2

References

https://gist.github.com/Sudistark/a5a45bd0804d522a1392cb5023aa7ef7
https://github.com/NaturalIntelligence/fast-xml-parser/commit/2b032a4f799c63d83991e4f992f1c68e4dd05804
https://github.com/advisories/GHSA-793h-6f7r-6qvm
https://gist.github.com/Sudistark/a5a45bd0804d522a1392cb5023aa7ef7
https://github.com/NaturalIntelligence/fast-xml-parser/commit/2b032a4f799c63d83991e4f992f1c68e4dd05804

Check your stack JSON