GHSA-gpv5-7x3g-ghjv: Fast xml parser Fast-xml-parser Regex Vulnerability Patch Could Vulnerability

LOW
Share
Published
Advisory Summary

GHSA-gpv5-7x3g-ghjv is a LOW fast-xml-parser regex vulnerability patch could vulnerability (General Security Weakness) affecting Fast xml parser libraries in the npm ecosystem. The issue involves fast-xml-parser regex vulnerability patch could be improved from a safety perspective. Remediation is available by upgrading affected packages to version 4.2.5.

GHSA-gpv5-7x3g-ghjv at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-gpv5-7x3g-ghjv
Severity LOW
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Fast xml parser
Package Ecosystem npm
Published Date
Last Updated

How to Fix GHSA-gpv5-7x3g-ghjv

To remediate this vulnerability, upgrade all affected Fast xml parser dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

fast-xml-parser fixed: 4.2.5 
npm install fast-xml-parser@4.2.5
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

npm ls fast-xml-parser

How to Check if You Are Affected

To determine whether your Node.js application is affected by GHSA-gpv5-7x3g-ghjv, inspect your project dependencies using npm:

npm ls fast-xml-parser

Analyze the terminal output to locate any version of Fast xml parser in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.2.5), your application is affected.

Note: The npm ls fast-xml-parser command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Fast xml parser, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary This is a comment on https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-6w63-h3fj-q4vw and the patches fixing it. ### Details The code which validates a name calls the validator: https://github.com/NaturalIntelligence/fast-xml-parser/blob/ecf6016f9b48aec1a921e673158be0773d07283e/src/xmlparser/DocTypeReader.js#L145-L153 This checks for the presence of an invalid character. Such an approach is always risky, as it is so easy to forget to include an invalid character in the list. A safer approach is to validate entity names against the XML specification: https://www.w3.org/TR/xml11/#sec-common-syn - an ENTITY name is a Name: ``` [4] NameStartChar ::= ":" | [A-Z] | "_" | [a-z] | [#xC0-#xD6] | [#xD8-#xF6] | [#xF8-#x2FF] | [#x370-#x37D] | [#x37F-#x1FFF] | [#x200C-#x200D] | [#x2070-#x218F] | [#x2C00-#x2FEF] | [#x3001-#xD7FF] | [#xF900-#xFDCF] | [#xFDF0-#xFFFD] | [#x10000-#xEFFFF] [4a] NameChar ::= NameStartChar | "-" | "." | [0-9] | #xB7 | [#x0300-#x036F] | [#x203F-#x2040] [5] Name ::= NameStartChar (NameChar)* ``` so the safest way to validate an entity name is to build a regex to represent this expression and check whether the name given matches the regex. (Something along the lines of `/^[name start char class][name char class]*$/`.) There's probably a nice way to simplify the explicit list rather than typing it out verbatim using Unicode character properties, but I don't know enough to do so.

GHSA-gpv5-7x3g-ghjv Affected Fast xml parser Versions

1 component(s)
Fixed Versions:
4.2.5
Product / Package Ecosystem Affected Versions Fixed Version
fast-xml-parser
npm/fast-xml-parser
npm
≥ 4.2.4
< 4.2.5
All 1 versions
4.2.4
4.2.5

References

GitHub Advisory / Wiki ADVISORY
https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-6w63-h3fj-q4vw
GitHub Advisory / Wiki ADVISORY
https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-gpv5-7x3g-ghjv
Security Fix Commit FIX COMMIT
https://github.com/NaturalIntelligence/fast-xml-parser/commit/9a880b887916855c3a510869fd1ee268d7fe58b1
Fast xml parser Source Repository REPOSITORY
https://github.com/NaturalIntelligence/fast-xml-parser

Frequently Asked Questions

What is GHSA-gpv5-7x3g-ghjv?
GHSA-gpv5-7x3g-ghjv is a security vulnerability in Fast xml parser involving fast-xml-parser regex vulnerability patch could be improved from a safety perspective under General Security Weakness.
Which Fast xml parser versions are affected?
Affected versions include releases prior to 4.2.5 across affected packages: fast-xml-parser.
What version fixes GHSA-gpv5-7x3g-ghjv?
Upgrading to 4.2.5 (or the latest patched release for your respective branch) resolves the vulnerability.
Is fast-xml-parser affected?
Yes, fast-xml-parser is affected in releases prior to 4.2.5. Upgrade your dependency to 4.2.5 or later.
What CWE is associated with GHSA-gpv5-7x3g-ghjv?
GHSA-gpv5-7x3g-ghjv is classified under General Security Weakness.
How can I check npm dependencies for GHSA-gpv5-7x3g-ghjv?
Run the dependency tree command: 'npm ls fast-xml-parser'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-gpv5-7x3g-ghjv",
  "modified" : "2023-06-15T19:05:13Z",
  "published" : "2023-06-15T19:05:13Z",
  "aliases" : [ ],
  "summary" : "fast-xml-parser regex vulnerability patch could be improved from a safety perspective",
  "details" : "### Summary\nThis is a comment on https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-6w63-h3fj-q4vw and the patches fixing it.\n\n### Details\nThe code which validates a name calls the validator:\nhttps://github.com/NaturalIntelligence/fast-xml-parser/blob/ecf6016f9b48aec1a921e673158be0773d07283e/src/xmlparser/DocTypeReader.js#L145-L153\nThis checks for the presence of an invalid character.  Such an approach is always risky, as it is so easy to forget to include an invalid character in the list.  A safer approach is to validate entity names against the XML specification: https://www.w3.org/TR/xml11/#sec-common-syn - an ENTITY name is a Name:\n\n```\n[4]   NameStartChar ::= \":\" | [A-Z] | \"_\" | [a-z] | [#xC0-#xD6] | [#xD8-#xF6] | [#xF8-#x2FF] | [#x370-#x37D] |\n                        [#x37F-#x1FFF] | [#x200C-#x200D] | [#x2070-#x218F] | [#x2C00-#x2FEF] | [#x3001-#xD7FF] |\n                        [#xF900-#xFDCF] | [#xFDF0-#xFFFD] | [#x10000-#xEFFFF]\n[4a]  NameChar ::= NameStartChar | \"-\" | \".\" | [0-9] | #xB7 | [#x0300-#x036F] | [#x203F-#x2040]\n[5]   Name ::= NameStartChar (NameChar)*\n```\n\nso the safest way to validate an entity name is to build a regex to represent this expression and check whether the name given matches the regex.  (Something along the lines of `/^[name start char class][name char class]*$/`.)  There's probably a nice way to simplify the explicit list rather than typing it out verbatim using Unicode character properties, but I don't know enough to do so.",
  "severity" : [ ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "fast-xml-parser"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.2.4"
      }, {
        "fixed" : "4.2.5"
      } ]
    } ],
    "versions" : [ "4.2.4" ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-6w63-h3fj-q4vw"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-gpv5-7x3g-ghjv"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/NaturalIntelligence/fast-xml-parser/commit/9a880b887916855c3a510869fd1ee268d7fe58b1"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/NaturalIntelligence/fast-xml-parser"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2023-06-15T19:05:13Z",
    "nvd_published_at" : null
  }
}