Skip to content
Fencer Vulns
critical 9.4

CVE-2022-39353 json

xmldom allows multiple root nodes in a DOM

published 2022-11-01 4 y ago modified 2026-09-10 1 mo ago also GHSA-crh6-fp67-6883 , EUVD-2022-7316

cvss
9.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.6%
EPSS 1.6% chance of exploitation in 30 days, percentile 75%
public exploits
0
none known

Summary

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a document that has more then 1 `childNode`.

Patch / fix

  • npm @xmldom/xmldom 0.7.7, 0.8.4, 0.9.0-beta.4
  • xmldom_project xmldom 0.6.0, 0.7.7, 0.8.4
  • node-xmldom Debian 14, Debian 13, Debian 12 0.8.6-1

debian advisories DEBIAN-CVE-2022-39353

  • node-xmldom Ubuntu 20.04 LTS 0.1.27+ds-1+deb10u2build0.20.04.1
  • node-xmldom Ubuntu 22.04 LTS 0.7.5-1ubuntu0.22.04.1

ubuntu advisories UBUNTU-CVE-2022-39353

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python-tensorboard Azure Linux 3.0 2.16.2-1

azure linux advisories AZL-38671

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-39353 updated cvss 9.4

xmldom: Allows multiple root elements in a DOM tree

  • Red Hat OpenShift Container Platform 3.11 openshift3/ose-console Red Hat OpenShift Container Platform 4 openshift4/ose-console
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
18 mo ago

Exploit prediction

1.56% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/jindw/xmldom/issues/150 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
npm xmldom
<=0.6.0
 no fix listed
npm @xmldom/xmldom
<0.7.7
>=0.8.0, <0.8.4
>=0.9.0-beta.1, <0.9.0-beta.4
0.7.7
0.8.4
0.9.0-beta.4

Affected products

  • xmldom xmldom

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-1288 Improper Validation of Consistency within Input

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.