CVE-2022-39353: xmldom allows multiple root nodes in a DOM
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the childNodes collection of the Document, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the documentElementor reject a document with a document that has more then 1 childNode.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-39353?
CVE-2022-39353 is classified as a moderate severity vulnerability due to improper handling of malformed XML.
How do I fix CVE-2022-39353?
To fix CVE-2022-39353, update to version 0.6.1 or later of the xmldom package.
Which versions of xmldom are affected by CVE-2022-39353?
CVE-2022-39353 affects xmldom versions prior to 0.6.1, including versions up to 0.6.0 and from 0.7.0 to 0.8.4, as well as beta releases 0.9.0-beta1, beta2, and beta3.
What types of applications are impacted by CVE-2022-39353?
CVE-2022-39353 impacts applications that utilize the xmldom library for parsing XML in Node.js environments.
Is CVE-2022-39353 relevant on Debian systems?
Yes, CVE-2022-39353 is relevant on Debian systems running versions of xmldom prior to the patched release.