REDHAT-BUG-2467631: High severity npm/@xmldom/xmldom vulnerability
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled comment content to be serialized into XML without validating or neutralizing comment-breaking sequences. As a result, an attacker can terminate the comment early and inject arbitrary XML nodes into the serialized output. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@xmldom/xmldomto a version that resolves this vulnerability.Fixed in 0.9.10 - Upgrade
Upgrade
@xmldom/xmldomto a version that resolves this vulnerability.Fixed in 0.8.13
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using affected xmldom or @xmldom/xmldom versions are exposed when they serialize XML documents containing comment content that an attacker can control.
What does an attacker need to exploit it?
The attacker needs a way to supply comment text that is later passed through XML serialization. They can use comment-breaking sequences to end the comment and insert arbitrary XML nodes into the serialized output.
Which versions contain fixes?
Fixes are available in @xmldom/xmldom 0.9.10 and 0.8.13. The issue affects xmldom 0.6.0 and earlier, while the provided information does not identify a fixed release for the xmldom package.
What can be done if upgrading is not immediately possible?
Do not allow untrusted input to become XML comment content before serialization. Validate or neutralize comment-breaking sequences in attacker-controlled comment data.