Is CVE-2022-39353 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-39353 being exploited in the wild.

How severe is CVE-2022-39353?

Low severity, with a CVSS score of 3.1, published 1 November 2022.

Which products and versions are affected?

@xmldom/xmldom (npm) SEMVER:introduced=0,fixed=0.7.7; xmldom (npm) SEMVER:introduced=0,last_affected=0.6.0.

Is there a fix for CVE-2022-39353?

Yes. @xmldom/xmldom (npm): upgrade to 0.7.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-39353 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-39353?

Check whether you run @xmldom/xmldom (npm) or xmldom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-39353: xmldom multiple root nodes in DOM

CVE-2022-39353 · Severity: low · CVSS 3.1 · Published 2022-11-01

xmldom is a JavaScript XML parser library used in applications that process XML documents. The library fails to reject malformed XML with multiple root elements, silently adding all roots to the document tree instead of reporting an error. This violates the XML standard and can cause dependent applications to make incorrect security or logic decisions based on a broken DOM structure.

Technologies: @xmldom/xmldom (npm), xmldom (npm). Vendors: npm.

Quick answers

Is CVE-2022-39353 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-39353 being exploited in the wild.
How severe is CVE-2022-39353?: Low severity, with a CVSS score of 3.1, published 1 November 2022.
Which products and versions are affected?: @xmldom/xmldom (npm) SEMVER:introduced=0,fixed=0.7.7; xmldom (npm) SEMVER:introduced=0,last_affected=0.6.0.
Is there a fix for CVE-2022-39353?: Yes. @xmldom/xmldom (npm): upgrade to 0.7.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-39353 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-39353?: Check whether you run @xmldom/xmldom (npm) or xmldom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@xmldom/xmldom (npm): upgrade to 0.7.7 or later
```
npm install @xmldom/xmldom@0.7.7
```

Technical details

The vulnerability is an improper input validation flaw (CWE-20, CWE-1288) in the XML parser's handling of well-formedness checks. xmldom parses non-compliant XML containing multiple top-level elements and adds all root nodes to the Document's childNodes collection without throwing an error or warning. This violates the XML specification, which mandates a single document element. Attackers can exploit this by providing malformed XML that breaks assumptions in downstream code that rely on the DOM tree having only one root node, potentially leading to security bypasses or unexpected behavior. Patches are available in @xmldom/xmldom versions 0.7.7, 0.8.4, and 0.9.0-beta.4 or later.

Affected products

xmldom @xmldom/xmldom <0.7.7, >=0.8.0 <0.8.4, >=0.9.0-beta.1 <0.9.0-beta.4
xmldom xmldom all previous versions

Identifiers

CVE-2022-39353
GHSA-crh6-fp67-6883

Timeline

2022-10-29: disclosed
2022-11-01: advisory: Public advisory GHSA-crh6-fp67-6883 published
2022-11: patched: Patches released: @xmldom/xmldom 0.7.7, 0.8.4, 0.9.0-beta.4

References

https://github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.