Description
xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the childNodes collection of the Document, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to https://nvd.nist.
Recommendation
Update the @xmldom/xmldom package to the latest compatible version. Followings are version details:
Affected version(s): **>= 0.9.0-beta.1, < 0.9.0-beta.4 >= 0.8.0, < 0.8.4 < 0.7.7** Patched version(s): **0.9.0-beta.4 0.8.4 0.7.7**
References
Could your website be exposed too?
SmartScanner can check your website for xmldom allows multiple root nodes in a DOM and gives you actionable findings to investigate.
Start a free scanRelated Issues
- xmldom allows multiple root nodes in a DOM - xmldom - CVE-2022-39353
- xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion - CVE-2026-34601
- nadesiko3 allows remote attacker to inject invalid value to decodeURIComponent of nako3edit - CVE-2022-41777
- xmldom has XML node injection through unvalidated comment serialization - CVE-2026-41672
You might also like:
See something that needs correcting? Let us knowUpdated March 31, 2023