REDHAT-BUG-2467630: High severity npm/@xmldom/xmldom vulnerability
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, seven recursive traversals in lib/dom.js operate without a depth limit. A sufficiently deeply nested DOM tree causes a RangeError: Maximum call stack size exceeded, crashing the application. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@xmldom/xmldomto a version that resolves this vulnerability.Fixed in 0.9.10 - Upgrade
Upgrade
@xmldom/xmldomto a version that resolves this vulnerability.Fixed in 0.8.13
Event History
Frequently Asked Questions
What input would an attacker need to trigger the crash?
The attacker would need to cause the application to process a sufficiently deeply nested DOM tree. The recursive traversals in lib/dom.js can then exceed the JavaScript call stack limit and raise a RangeError.
Which package versions are affected and which versions contain the fix?
The issue affects xmldom 0.6.0 and earlier, plus @xmldom/xmldom releases before 0.8.13 and releases from 0.9.0 through 0.9.9. Fixed versions are @xmldom/xmldom 0.8.13 and 0.9.10.
What is the expected impact if exploitation succeeds?
Processing the maliciously deep DOM tree can cause a RangeError: Maximum call stack size exceeded and crash the application.