CVE-2022-39353
Fixed in a distro release EPSS 1%CVSS 9.4
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a document that has more then 1 `childNode`.
Products: xmldom
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | @xmldom/xmldom | 0.7.7 |
| npm | @xmldom/xmldom | 0.8.4 |
| npm | @xmldom/xmldom | 0.9.0-beta.4 |
| npm | xmldom | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | wazuh-dashboard-security-plugin | 4.14.6-r3 |
| Chainguard | wazuh-dashboard-security-plugin-fips | 4.14.6-r1 |
| Debian 10 | node-xmldom | 0.1.27+ds-1+deb10u2 |
| Debian 12 | node-xmldom | 0.8.6-1 |
| Debian 13 | node-xmldom | 0.8.6-1 |
| Debian 14 | node-xmldom | 0.8.6-1 |
| Ubuntu 20.04 LTS | node-xmldom | 0.1.27+ds-1+deb10u2build0.20.04.1 |
| Ubuntu 22.04 LTS | node-xmldom | 0.7.5-1ubuntu0.22.04.1 |
| Ubuntu 25.10 | node-xmldom | no fix |