fast-xml-parser dependency has a vulnerability

[jdforsythe]

Checkboxes for prior research

• I've gone through Developer Guide and API reference
• I've checked AWS Forums and StackOverflow.
• I've searched for previous similar issues and didn't find any solution.

Describe the bug

$ yarn audit --groups dependencies
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ low           │ fast-xml-parser regex vulnerability patch could be improved  │
│               │ from a safety perspective                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ fast-xml-parser                                              │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ No patch available                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @aws-sdk/client-s3                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @aws-sdk/client-s3 > fast-xml-parser                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1092278                     │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ low           │ fast-xml-parser regex vulnerability patch could be improved  │
│               │ from a safety perspective                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ fast-xml-parser                                              │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ No patch available                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @aws-sdk/client-s3                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @aws-sdk/client-s3 > @aws-sdk/client-sts > fast-xml-parser   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1092278                     │
└───────────────┴──────────────────────────────────────────────────────────────┘

SDK version number

@aws-sdk/[email protected]

Which JavaScript Runtime is this issue in?

Node.js

Details of the browser/Node.js/ReactNative version

all

Reproduction Steps

Run npm audit

Observed Behavior

vulnerability present

Expected Behavior

no vulnerability present

Possible Solution

No patch appears to be available yet. Track fast-xml-parser for an update.

Additional Information/Context

https://www.npmjs.com/advisories/1092278

@bkaws @RanVaknin here we go again!

I did double-check this time, and v3.357.0 is the newest version.

[jdforsythe]

Tracking issue: NaturalIntelligence/fast-xml-parser#591

[aaleksandrov]

fast-xml-parser author has just published a fixed version v 4.2.5
https://www.npmjs.com/package/fast-xml-parser

[yenfryherrerafeliz]

Hi @jdforsythe, thanks for reporting this. We are currently working on getting a patch for this.

Thanks!

[kuhe]

fast-xml-parser dependency is set to 4.2.5 in the following released version:
https://github.com/aws/aws-sdk-js-v3/releases/tag/v3.359.0

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs and link to relevant comments in this thread.