Multiple Root Node Issue in xmldom Package Leading to CVE-2022-39353
Summary
CVE-2022-39353: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Affects node-xmldom across 2 version ranges.
< 0.5.0-1+deb11u2
< c80a161172cc4d8733583bf0cf59abfa589f6d9e
Fixed in 0.5.0-1+deb11u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
xmldom is a pure JavaScript implementation of the W3C standard-based XML DOM Level 2 Core, providing functionalities such as DOMParser and XMLSerializer. It is widely used for parsing and manipulating XML documents in JavaScript environments. The package is designed to handle well-formed XML, but it has a critical flaw that allows it to parse XML documents with multiple top-level elements, which can lead to unexpected behavior in applications relying on a single root node.
Vulnerability Detail
The vulnerability arises from xmldom's ability to parse XML documents that are not well-formed, specifically those containing multiple top-level elements. Instead of throwing an error, xmldom adds all root nodes to the childNodes collection of the Document. This behavior breaks the fundamental assumption that a valid XML document should have only one root node, potentially leading to security issues in applications that depend on this structure. The vulnerability has been assigned CVE-2022-39353, with a CVSS score of 9.8, indicating a high severity level.
How To Fix
Minimum fixed version
0.5.0-1+deb11u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-xmldomTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement one of the following strategies based on your use case: 1. Instead of searching for elements in the entire DOM, limit your search to the documentElement. 2. Reject any document that has more than one childNode. This can be done with the following code snippet:
if (document.childNodes.length > 1) {
throw new Error('Invalid XML: More than one root node detected.');
}
Conclusion
The xmldom package has a significant vulnerability (CVE-2022-39353) that allows parsing of improperly structured XML documents. It is crucial to update to a secure version of the package to protect your applications from potential security risks. Implementing workarounds can provide temporary relief until an update is feasible.
See every vulnerability recorded for node-xmldom →
FAQ
CVE-2022-39353 is a vulnerability in the xmldom package that allows parsing of XML documents with multiple root nodes, leading to potential security issues.
If your application relies on xmldom to parse XML, it may behave unexpectedly or expose security risks due to the presence of multiple root nodes.
The CVSS score of CVE-2022-39353 is 9.8, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
If you cannot update the package right away, implement the suggested workarounds to mitigate the risk until you can apply the necessary updates.
Related vulnerabilities
Recent vulnerabilities recorded for node-xmldom.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
