xmldom allows multiple root nodes in a DOM - xmldom

Description

xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the childNodes collection of the Document, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to https://nvd.nist.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.6.0

References

• GHSA-crh6-fp67-6883
• lists.debian.org
• CVE-2022-39353
• CWE-1288
• CWE-20
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• xmldom allows multiple root nodes in a DOM - CVE-2022-39353
• nadesiko3 allows remote attacker to inject invalid value to decodeURIComponent of nako3edit - CVE-2022-41777
• Plate allows arbitrary DOM attributes in element.attributes and leaf.attributes - CVE-2024-47061
• xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion - CVE-2026-34601

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

xmldom