Description
xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the childNodes collection of the Document, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to https://nvd.nist.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 0.6.0
References
Could your website be exposed too?
SmartScanner can check your website for xmldom allows multiple root nodes in a DOM - xmldom and gives you actionable findings to investigate.
Start a free scanRelated Issues
- xmldom allows multiple root nodes in a DOM - CVE-2022-39353
- nadesiko3 allows remote attacker to inject invalid value to decodeURIComponent of nako3edit - CVE-2022-41777
- Plate allows arbitrary DOM attributes in element.attributes and leaf.attributes - CVE-2024-47061
- xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion - CVE-2026-34601
You might also like:
See something that needs correcting? Let us knowUpdated March 31, 2023