CVE-2022-39353: xmldom allows multiple root nodes in a DOM
First published: Wed Nov 02 2022(Updated: )
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a document that has more then 1 `childNode`.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| xmldom | <0.6.0 | |
| xmldom | >=0.7.0<0.7.7 | |
| xmldom | >=0.8.0<0.8.4 | |
| xmldom | =0.9.0-beta1 | |
| xmldom | =0.9.0-beta2 | |
| xmldom | =0.9.0-beta3 | |
| Debian GNU/Linux | =10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-39353?
CVE-2022-39353 is classified as a moderate severity vulnerability due to improper handling of malformed XML.
How do I fix CVE-2022-39353?
To fix CVE-2022-39353, update to version 0.6.1 or later of the xmldom package.
Which versions of xmldom are affected by CVE-2022-39353?
CVE-2022-39353 affects xmldom versions prior to 0.6.1, including versions up to 0.6.0 and from 0.7.0 to 0.8.4, as well as beta releases 0.9.0-beta1, beta2, and beta3.
What types of applications are impacted by CVE-2022-39353?
CVE-2022-39353 impacts applications that utilize the xmldom library for parsing XML in Node.js environments.
Is CVE-2022-39353 relevant on Debian systems?
Yes, CVE-2022-39353 is relevant on Debian systems running versions of xmldom prior to the patched release.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/references
- agent/title
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/xmldom project
- canonical/xmldom
- version/xmldom/0.7.0
- version/xmldom/0.8.0
- version/xmldom/0.9.0-beta1
- version/xmldom/0.9.0-beta2
- version/xmldom/0.9.0-beta3
- vendor/debian
- canonical/debian gnu/linux
- version/debian gnu/linux/10.0