Impact
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package.
Patches
Update to @xmldom/xmldom@~0.7.6, @xmldom/xmldom@~0.8.3 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.2 (dist-tag next).
Workarounds
None
Impact
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package.
Patches
Update to @xmldom/xmldom@~0.7.6, @xmldom/xmldom@~0.8.3 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.2 (dist-tag next).
Workarounds
None
References
https://github.com/xmldom/xmldom/pull/437
For more information
If you have any questions or comments about this advisory:
- Email us at security@xmldom.org
- Add information to https://github.com/xmldom/xmldom/issues/436
References
- https://github.com/xmldom/xmldom/security/advisories/GHSA-9pgh-qqpf-7wqj
- https://nvd.nist.gov/vuln/detail/CVE-2022-37616
- https://github.com/xmldom/xmldom/issues/436
- https://github.com/xmldom/xmldom/pull/437
- https://github.com/xmldom/xmldom/blob/bc36efddf9948aba15618f85dc1addfc2ac9d7b2/lib/dom.js#L1
- https://github.com/xmldom/xmldom/blob/bc36efddf9948aba15618f85dc1addfc2ac9d7b2/lib/dom.js#L3
- https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md#076
- https://lists.debian.org/debian-lts-announce/2022/10/msg00023.html
- https://github.com/advisories/GHSA-9pgh-qqpf-7wqj