CVE-2022-39353 (GCVE-0-2022-39353)

Vulnerability from cvelistv5 – Published: 2022-11-02 00:00 – Updated: 2025-04-22 17:16
VLAI
Title
xmldom allows multiple root nodes in a DOM
Summary
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a document that has more then 1 `childNode`.
Severity
9.4 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
SSVC
Exploitation: poc Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-22 15:39 UTC
CWE
  • CWE-20 - Improper Input Validation
  • CWE-1288 - Improper Validation of Consistency within Input
Assigner
References
Impacted products
Vendor Product Version CPE status
xmldom xmldom Affected: <= 0.6.0
Affected: < 0.7.7
Affected: >= 0.8.0, < 0.8.4
Affected: >= 0.9.0-beta.1, < 0.9.0-beta.4
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T12:00:44.144Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/jindw/xmldom/issues/150"
          },
          {
            "name": "[debian-lts-announce] 20230101 [SECURITY] [DLA 3260-1] node-xmldom security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00000.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-39353",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-22T15:39:20.618073Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-22T17:16:38.092Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "xmldom",
          "vendor": "xmldom",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 0.6.0"
            },
            {
              "status": "affected",
              "version": "\u003c 0.7.7"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.8.0, \u003c 0.8.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.9.0-beta.1, \u003c 0.9.0-beta.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@\u003e=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a document that has more then 1 `childNode`."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1288",
              "description": "CWE-1288: Improper Validation of Consistency within Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-01-01T00:00:00.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883"
        },
        {
          "url": "https://github.com/jindw/xmldom/issues/150"
        },
        {
          "name": "[debian-lts-announce] 20230101 [SECURITY] [DLA 3260-1] node-xmldom security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00000.html"
        }
      ],
      "source": {
        "advisory": "GHSA-crh6-fp67-6883",
        "discovery": "UNKNOWN"
      },
      "title": "xmldom allows multiple root nodes in a DOM"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-39353",
    "datePublished": "2022-11-02T00:00:00.000Z",
    "dateReserved": "2022-09-02T00:00:00.000Z",
    "dateUpdated": "2025-04-22T17:16:38.092Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-39353",
      "date": "2026-09-22",
      "epss": "0.01272",
      "percentile": "0.68588"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:xmldom_project:xmldom:*:*:*:*:*:node.js:*:*",
                  "matchCriteriaId": "AE53B86A-F7D4-47C7-ADB7-E88EAD0C2044",
                  "versionEndExcluding": "0.6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:xmldom_project:xmldom:*:*:*:*:*:node.js:*:*",
                  "matchCriteriaId": "96FDE7F1-77D9-402A-B5CB-DE6071DE4813",
                  "versionEndExcluding": "0.7.7",
                  "versionStartIncluding": "0.7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:xmldom_project:xmldom:*:*:*:*:*:node.js:*:*",
                  "matchCriteriaId": "C525AC8C-417F-4CF1-B26C-DE55EF338372",
                  "versionEndExcluding": "0.8.4",
                  "versionStartIncluding": "0.8.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:xmldom_project:xmldom:0.9.0:beta1:*:*:*:node.js:*:*",
                  "matchCriteriaId": "884B240D-F39F-4283-825B-DCACEACCF56F",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:xmldom_project:xmldom:0.9.0:beta2:*:*:*:node.js:*:*",
                  "matchCriteriaId": "239CB56A-A53C-4FF3-ADAD-A9E0435582D3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:xmldom_project:xmldom:0.9.0:beta3:*:*:*:node.js:*:*",
                  "matchCriteriaId": "85330F73-D8B8-44C3-89F4-31051F0CCE46",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@\u003e=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a document that has more then 1 `childNode`."
        },
        {
          "lang": "es",
          "value": "xmldom es un m\u00f3dulo `DOMParser` y `XMLSerializer` basado en el est\u00e1ndar W3C de JavaScript puro (XML DOM Level 2 Core). xmldom analiza XML que no est\u00e1 bien formado porque contiene m\u00faltiples elementos de nivel superior y agrega todos los nodos ra\u00edz a la colecci\u00f3n `childNodes` del `Documento`, sin informar ning\u00fan error ni arrojar. Esto rompe la suposici\u00f3n de que solo hay un nodo ra\u00edz en el \u00e1rbol, lo que llev\u00f3 a la emisi\u00f3n de CVE-2022-39299, ya que es un problema potencial para los dependientes. Actualice a @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag m\u00e1s reciente) o @xmldom/xmldom@\u0026gt;=0.9.0-beta.4 (dist-tag siguiente). Como workaround, utilice uno de los siguientes enfoques seg\u00fan su caso de uso: en lugar de buscar elementos en todo el DOM, solo busque en `documentElement` o rechace un documento con un documento que tenga m\u00e1s de 1 `childNode`."
        }
      ],
      "id": "CVE-2022-39353",
      "lastModified": "2024-11-21T07:18:06.040",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.4,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "LOW",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 3.9,
            "impactScore": 5.5,
            "source": "security-advisories@github.com",
            "type": "Secondary"
          },
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 3.9,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2022-11-02T17:15:17.387",
      "references": [
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Exploit",
            "Issue Tracking",
            "Third Party Advisory"
          ],
          "url": "https://github.com/jindw/xmldom/issues/150"
        },
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883"
        },
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Mailing List",
            "Third Party Advisory"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00000.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Exploit",
            "Issue Tracking",
            "Third Party Advisory"
          ],
          "url": "https://github.com/jindw/xmldom/issues/150"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Mailing List",
            "Third Party Advisory"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00000.html"
        }
      ],
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-20"
            },
            {
              "lang": "en",
              "value": "CWE-1288"
            }
          ],
          "source": "security-advisories@github.com",
          "type": "Secondary"
        },
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-20"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "microsoft_vex": {
      "current_release_date": "2024-06-30T07:00:00.000Z",
      "cve": "CVE-2022-39353",
      "id": "msrc_CVE-2022-39353",
      "initial_release_date": "2022-11-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "xmldom allows multiple root nodes in a DOM",
      "url": "https://msrc.microsoft.com/csaf/vex/2022/msrc_cve-2022-39353.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "xmldom",
                "vendor": "xmldom",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c= 0.6.0"
                  },
                  {
                    "status": "affected",
                    "version": "\u003c 0.7.7"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 0.8.0, \u003c 0.8.4"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 0.9.0-beta.1, \u003c 0.9.0-beta.4"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:xmldom_project:xmldom:*:*:*:*:*:node.js:*:*",
                    "matchCriteriaId": "AE53B86A-F7D4-47C7-ADB7-E88EAD0C2044",
                    "versionEndExcluding": "0.6.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:xmldom_project:xmldom:*:*:*:*:*:node.js:*:*",
                    "matchCriteriaId": "96FDE7F1-77D9-402A-B5CB-DE6071DE4813",
                    "versionEndExcluding": "0.7.7",
                    "versionStartIncluding": "0.7.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:xmldom_project:xmldom:*:*:*:*:*:node.js:*:*",
                    "matchCriteriaId": "C525AC8C-417F-4CF1-B26C-DE55EF338372",
                    "versionEndExcluding": "0.8.4",
                    "versionStartIncluding": "0.8.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:xmldom_project:xmldom:0.9.0:beta1:*:*:*:node.js:*:*",
                    "matchCriteriaId": "884B240D-F39F-4283-825B-DCACEACCF56F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:xmldom_project:xmldom:0.9.0:beta2:*:*:*:node.js:*:*",
                    "matchCriteriaId": "239CB56A-A53C-4FF3-ADAD-A9E0435582D3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:xmldom_project:xmldom:0.9.0:beta3:*:*:*:node.js:*:*",
                    "matchCriteriaId": "85330F73-D8B8-44C3-89F4-31051F0CCE46",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@\u003e=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a document that has more then 1 `childNode`."
          },
          {
            "lang": "es",
            "value": "xmldom es un m\u00f3dulo `DOMParser` y `XMLSerializer` basado en el est\u00e1ndar W3C de JavaScript puro (XML DOM Level 2 Core). xmldom analiza XML que no est\u00e1 bien formado porque contiene m\u00faltiples elementos de nivel superior y agrega todos los nodos ra\u00edz a la colecci\u00f3n `childNodes` del `Documento`, sin informar ning\u00fan error ni arrojar. Esto rompe la suposici\u00f3n de que solo hay un nodo ra\u00edz en el \u00e1rbol, lo que llev\u00f3 a la emisi\u00f3n de CVE-2022-39299, ya que es un problema potencial para los dependientes. Actualice a @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag m\u00e1s reciente) o @xmldom/xmldom@\u0026gt;=0.9.0-beta.4 (dist-tag siguiente). Como workaround, utilice uno de los siguientes enfoques seg\u00fan su caso de uso: en lugar de buscar elementos en todo el DOM, solo busque en `documentElement` o rechace un documento con un documento que tenga m\u00e1s de 1 `childNode`."
          }
        ],
        "id": "CVE-2022-39353",
        "lastModified": "2026-06-17T04:58:12.050",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.4,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.5,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-39353",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-22T15:39:20.618073Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2022-11-02T17:15:17.387",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Issue Tracking",
              "Third Party Advisory"
            ],
            "url": "https://github.com/jindw/xmldom/issues/150"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00000.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Exploit",
              "Issue Tracking",
              "Third Party Advisory"
            ],
            "url": "https://github.com/jindw/xmldom/issues/150"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00000.html"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-20"
              },
              {
                "lang": "en",
                "value": "CWE-1288"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-20"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-06T20:56:15+00:00",
      "cve": "CVE-2022-39353",
      "id": "CVE-2022-39353",
      "initial_release_date": "2022-11-02T00:00:00+00:00",
      "product_status:known_not_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "xmldom: Allows multiple root elements in a DOM tree",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-39353.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-03T12:00:44.144Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://github.com/jindw/xmldom/issues/150"
              },
              {
                "name": "[debian-lts-announce] 20230101 [SECURITY] [DLA 3260-1] node-xmldom security update",
                "tags": [
                  "mailing-list",
                  "x_transferred"
                ],
                "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00000.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-39353",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-04-22T15:39:20.618073Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-04-22T15:39:21.909Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "xmldom",
              "vendor": "xmldom",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c= 0.6.0"
                },
                {
                  "status": "affected",
                  "version": "\u003c 0.7.7"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 0.8.0, \u003c 0.8.4"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 0.9.0-beta.1, \u003c 0.9.0-beta.4"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@\u003e=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a document that has more then 1 `childNode`."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.4,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-20",
                  "description": "CWE-20: Improper Input Validation",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-1288",
                  "description": "CWE-1288: Improper Validation of Consistency within Input",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2023-01-01T00:00:00.000Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883"
            },
            {
              "url": "https://github.com/jindw/xmldom/issues/150"
            },
            {
              "name": "[debian-lts-announce] 20230101 [SECURITY] [DLA 3260-1] node-xmldom security update",
              "tags": [
                "mailing-list"
              ],
              "url": "https://lists.debian.org/debian-lts-announce/2023/01/msg00000.html"
            }
          ],
          "source": {
            "advisory": "GHSA-crh6-fp67-6883",
            "discovery": "UNKNOWN"
          },
          "title": "xmldom allows multiple root nodes in a DOM"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2022-39353",
        "datePublished": "2022-11-02T00:00:00.000Z",
        "dateReserved": "2022-09-02T00:00:00.000Z",
        "dateUpdated": "2025-04-22T17:16:38.092Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.