CVE-2022-37616: Critical severity xmldom vulnerability
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid"; however, some third parties takes the position that "A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted."
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2022-37616?
CVE-2022-37616 is classified as a prototype pollution vulnerability, which can have a moderate to high severity depending on the context of its exploitation.
How do I fix CVE-2022-37616?
To fix CVE-2022-37616, you should upgrade the xmldom package to version 0.8.3 or later.
What impact can CVE-2022-37616 have on my application?
CVE-2022-37616 can allow an attacker to manipulate object properties through prototype pollution, potentially leading to application instability or security bypasses.
Is CVE-2022-37616 present in all versions of xmldom?
No, CVE-2022-37616 affects versions of xmldom prior to 0.8.3.
Which platforms are affected by CVE-2022-37616?
CVE-2022-37616 affects Node.js applications that utilize the xmldom package.