Executive brief
xmldom is a JavaScript XML parser library used in applications that process XML documents. The library fails to reject malformed XML with multiple root elements, silently adding all roots to the document tree instead of reporting an error. This violates the XML standard and can cause dependent applications to make incorrect security or logic decisions based on a broken DOM structure.
Technical details
The vulnerability is an improper input validation flaw (CWE-20, CWE-1288) in the XML parser's handling of well-formedness checks. xmldom parses non-compliant XML containing multiple top-level elements and adds all root nodes to the Document's childNodes collection without throwing an error or warning. This violates the XML specification, which mandates a single document element. Attackers can exploit this by providing malformed XML that breaks assumptions in downstream code that rely on the DOM tree having only one root node, potentially leading to security bypasses or unexpected behavior. Patches are available in @xmldom/xmldom versions 0.7.7, 0.8.4, and 0.9.0-beta.4 or later.
Affected products
- xmldom @xmldom/xmldom <0.7.7, >=0.8.0 <0.8.4, >=0.9.0-beta.1 <0.9.0-beta.4
- xmldom xmldom all previous versions
Timeline
- 2022-10-29: disclosed
- 2022-11-01: advisory: Public advisory GHSA-crh6-fp67-6883 published
- 2022-11: patched: Patches released: @xmldom/xmldom 0.7.7, 0.8.4, 0.9.0-beta.4