cbcvebase.
CVE-2022-39353
published 2022-11-02

CVE-2022-39353: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because…

PriorityP344critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.18%
64.2th percentile
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a document that has more then 1 `childNode`.

Affected

15 ranges
VendorProductVersion rangeFixed in
debiandebian_linux
debiannode-xmldom< node-xmldom 0.8.6-1 (bookworm)node-xmldom 0.8.6-1 (bookworm)
msrcazl3_python-tensorboard_2.11.0-3_on_azure_linux_3.0
msrcazl3_python-tensorboard_2.16.2-1_on_azure_linux_3.0
msrcazure_linux_3.0_arm
msrcazure_linux_3.0_x64
msrccbl2_python-tensorboard_2.11.0-3_on_cbl_mariner_2.0
xmldomxmldom>= 0 < 0.7.70.7.7
xmldomxmldom0 – 0.6.0
xmldomxmldom>= 0.8.0 < 0.8.40.8.4
xmldomxmldom>= 0.9.0-beta.1 < 0.9.0-beta.40.9.0-beta.4
xmldom_projectxmldom< 0.6.00.6.0
xmldom_projectxmldom
xmldom_projectxmldom>= 0.7.0 < 0.7.70.7.7
xmldom_projectxmldom>= 0.8.0 < 0.8.40.8.4

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ghsa8.1HIGH
osv8.1HIGH
vendor_msrc9.8CRITICAL
vendor_debian7.4HIGH
vendor_redhat7.4HIGH
vendor_ubuntu4.3MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.