CVE-2022-39353
published 2022-11-02CVE-2022-39353: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because…
PriorityP344critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.18%
64.2th percentile
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a document that has more then 1 `childNode`.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | node-xmldom | < node-xmldom 0.8.6-1 (bookworm) | node-xmldom 0.8.6-1 (bookworm) |
| msrc | azl3_python-tensorboard_2.11.0-3_on_azure_linux_3.0 | — | — |
| msrc | azl3_python-tensorboard_2.16.2-1_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_python-tensorboard_2.11.0-3_on_cbl_mariner_2.0 | — | — |
| xmldom | xmldom | >= 0 < 0.7.7 | 0.7.7 |
| xmldom | xmldom | 0 – 0.6.0 | — |
| xmldom | xmldom | >= 0.8.0 < 0.8.4 | 0.8.4 |
| xmldom | xmldom | >= 0.9.0-beta.1 < 0.9.0-beta.4 | 0.9.0-beta.4 |
| xmldom_project | xmldom | < 0.6.0 | 0.6.0 |
| xmldom_project | xmldom | — | — |
| xmldom_project | xmldom | >= 0.7.0 < 0.7.7 | 0.7.7 |
| xmldom_project | xmldom | >= 0.8.0 < 0.8.4 | 0.8.4 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ghsa8.1HIGH
osv8.1HIGH
vendor_msrc9.8CRITICAL
vendor_debian7.4HIGH
vendor_redhat7.4HIGH
vendor_ubuntu4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
node-xmldom vulnerabilities
osv·2023-05-24·CVSS 4.3
CVE-2021-21366 [MEDIUM] node-xmldom vulnerabilities
node-xmldom vulnerabilities
It was discovered that xmldom incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause
unexpected syntactic changes during XML processing. This issue only affected
Ubuntu 20.04 LTS. (CVE-2021-21366)
It was discovered that xmldom incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a
denial of service. (CVE-2022-37616, CVE-2022-39353)
OSV
CVE-2022-39353: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module
osv·2022-11-02·CVSS 8.1
CVE-2022-39353 [HIGH] CVE-2022-39353: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a
GHSA
xmldom allows multiple root nodes in a DOM
ghsa·2022-11-01·CVSS 8.1
CVE-2022-39353 [HIGH] CWE-1288 xmldom allows multiple root nodes in a DOM
xmldom allows multiple root nodes in a DOM
### Impact
xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing.
This breaks the assumption that there is only a single root node in the tree, which led to https://nvd.nist.gov/vuln/detail/CVE-2022-39299 and is a potential issue for dependents.
### Patches
Update to `@xmldom/xmldom@~0.7.7`, `@xmldom/xmldom@~0.8.4` (dist-tag `latest`) or `@xmldom/xmldom@>=0.9.0-beta.4` (dist-tag `next`).
### Workarounds
One of the following approaches might help, depending on your use case:
- Instead of searching for elements in the whole DOM, only search in the `documentElement`.
- Reject a document with a docum
OSV
xmldom allows multiple root nodes in a DOM
osv·2022-11-01·CVSS 8.1
CVE-2022-39353 [HIGH] xmldom allows multiple root nodes in a DOM
xmldom allows multiple root nodes in a DOM
### Impact
xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing.
This breaks the assumption that there is only a single root node in the tree, which led to https://nvd.nist.gov/vuln/detail/CVE-2022-39299 and is a potential issue for dependents.
### Patches
Update to `@xmldom/xmldom@~0.7.7`, `@xmldom/xmldom@~0.8.4` (dist-tag `latest`) or `@xmldom/xmldom@>=0.9.0-beta.4` (dist-tag `next`).
### Workarounds
One of the following approaches might help, depending on your use case:
- Instead of searching for elements in the whole DOM, only search in the `documentElement`.
- Reject a document with a docum
Ubuntu
xmldom vulnerabilities
vendor_ubuntu·2023-05-24·CVSS 4.3
CVE-2021-21366 [MEDIUM] xmldom vulnerabilities
Title: xmldom vulnerabilities
Summary: Several security issues were fixed in xmldom.
It was discovered that xmldom incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause
unexpected syntactic changes during XML processing. This issue only affected
Ubuntu 20.04 LTS. (CVE-2021-21366)
It was discovered that xmldom incorrectly handled certain inputs. If a
user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a
denial of service. (CVE-2022-37616, CVE-2022-39353)
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
xmldom allows multiple root nodes in a DOM
vendor_msrc·2022-11-08·CVSS 9.8
CVE-2022-39353 [CRITICAL] CWE-20 xmldom allows multiple root nodes in a DOM
xmldom allows multiple root nodes in a DOM
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.micros
Red Hat
xmldom: Allows multiple root elements in a DOM tree
vendor_redhat·2022-11-02·CVSS 7.4
CVE-2022-39353 [HIGH] CWE-20 xmldom: Allows multiple root elements in a DOM tree
xmldom: Allows multiple root elements in a DOM tree
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search
Debian
CVE-2022-39353: node-xmldom - xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser...
vendor_debian·2022·CVSS 7.4
CVE-2022-39353 [HIGH] CVE-2022-39353: node-xmldom - xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser...
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/jindw/xmldom/issues/150https://github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883https://lists.debian.org/debian-lts-announce/2023/01/msg00000.htmlhttps://github.com/jindw/xmldom/issues/150https://github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883https://lists.debian.org/debian-lts-announce/2023/01/msg00000.html
2022-11-02
Published