Vulnerability · Published Oct 11, 2022 · Assigned by mitre

CVE-2022-37616

Critical 9.8

In plain English

A critical-severity security flaw in the node-xmldom package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)2.1%top 17.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid"; however, some third parties takes the position that "A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted."

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	node-xmldom	0.8.3-1	DEBIAN-CVE-2022-37616
Debian:13	node-xmldom	0.8.3-1	DEBIAN-CVE-2022-37616
Debian:14	node-xmldom	0.8.3-1	DEBIAN-CVE-2022-37616
Ubuntu:22.04:LTS	node-xmldom	0.7.5-1ubuntu0.22.04.1	USN-6102-1
Ubuntu:22.04:LTS	node-xmldom	0.7.5-1ubuntu0.22.04.1	UBUNTU-CVE-2022-37616
npm	@xmldom/xmldom	0.9.0-beta.2	GHSA-9pgh-qqpf-7wqj
npm	@xmldom/xmldom	0.7.6	GHSA-9pgh-qqpf-7wqj
npm	@xmldom/xmldom	0.8.3	GHSA-9pgh-qqpf-7wqj
npm	xmldom	no fix listed	GHSA-9pgh-qqpf-7wqj

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References