CVE-2022-37616
Critical
Description
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid"; however, some third parties takes the position that "A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted."
SeverityCritical
CVSS9.8
Exploit probability—
Product
Xmldom
PublishedOct 11, 2022
First seenOct 11, 2022
How to fix
Update
- xmldom_project xmldom0.7.6, 0.8.3 or later
- @xmldom/xmldom0.8.3, 0.9.0-beta.2, 0.7.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xmldom_project xmldom | v ≤ 0.6.0, 0.7.0 ≤ v < 0.7.6, 0.8.0 ≤ v < 0.8.3, 0.9.0 | 0.7.6, 0.8.3 |
| debian debian_linux | 10.0 | — |
| @xmldom/xmldomnpm | 0.8.0 ≤ v < 0.8.3, 0.9.0-beta.1 ≤ v < 0.9.0-beta.2, v < 0.7.6 | 0.8.3, 0.9.0-beta.2, 0.7.6 |
| xmldomnpm | v ≤ 0.6.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.