Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
When an input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into multiple attributes. This gives the room for an attacker to insert unwanted attributes to the XML/HTML. Detail Malicious Input Output Workarounds If you're not ignoring attributes then keep processEntities flag true.
Recommended action: Upgrade to 1.1.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The fix for https://github.com/advisories/GHSA-gh4j-gqv2-49f6 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace(/--/g, '- -'). This skip the values containing three consecutive dashes (e.g., ---...), allowing an attacker to break out of an XML comment and inject arbitrary XML/HTML content. Impact Any application with comment property enabled allow attacker to inject malicious or unwanted code like JS script tag in the XML/HTML output. Workarounds Check for the presence of 3 consecutive dashes externally in the property value used for comment tag.
Recommended action: Upgrade to 1.1.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.