CVE-2022-39353

    Dashboard / Vulnerabilities / CVE-2022-39353

    CVE-2022-39353

    Published: 2 Nov 2022Last Modified: 28 Oct 2026

    Summary: xmldom allows multiple root nodes in a DOM

    Details: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a document that has more then 1 `childNode`.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39353.json, https://github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883, https://nvd.nist.gov/vuln/detail/CVE-2022-39353, https://github.com/jindw/xmldom/issues/150, https://lists.debian.org/debian-lts-announce/2023/01/msg00000.html

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -c80a161172cc4d8733583bf0cf59abfa589f6d9e

    Affected versions

    0.8.3
    0.8.2
    0.8.1
    0.8.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-39353 | CVE-DB