{
  "cveId": "CVE-2022-39353",
  "url": "https://patchblox.com/security/cve/CVE-2022-39353",
  "summary": "CVE-2022-39353 is fixed in node-xmldom on 1 platform, first by node-xmldom 0.1.27\u002Bds-1\u002Bdeb10u2build0.20.04.1, released November 2, 2022. It is not reported as exploited. Patch Radar priority: Urgent.",
  "title": "node-xmldom: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) \u0060DOMParser\u0060 and \u0060XMLSerializer\u0060 module",
  "description": "xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) \u0060DOMParser\u0060 and \u0060XMLSerializer\u0060 module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the \u0060childNodes\u0060 collection of the \u0060Document\u0060, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@\u003E=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the \u0060documentElement\u0060or reject a document with a document that has more then 1 \u0060childNode\u0060.",
  "published": "2022-11-02T10:15:00Z",
  "severity": "critical",
  "cvss": 9.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.01559,
  "epssPercentile": 0.75369,
  "priority": "Urgent",
  "priorityTier": 2,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "node-xmldom",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "0.8.6-1",
      "fix": "DEBIAN-CVE-2022-39353",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-39353",
      "released": "2022-11-02T17:15:17Z"
    },
    {
      "platform": "linux",
      "product": "node-xmldom",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "0.8.6-1",
      "fix": "DEBIAN-CVE-2022-39353",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-39353",
      "released": "2022-11-02T17:15:17Z"
    },
    {
      "platform": "linux",
      "product": "node-xmldom",
      "release": "Debian 14",
      "fixedVersion": "0.8.6-1",
      "fix": "DEBIAN-CVE-2022-39353",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-39353",
      "released": "2022-11-02T17:15:17Z"
    },
    {
      "platform": "linux",
      "product": "node-xmldom",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "0.1.27\u002Bds-1\u002Bdeb10u2build0.20.04.1",
      "fix": "node-xmldom 0.1.27\u002Bds-1\u002Bdeb10u2build0.20.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-node-xmldom-0.1.27-ds-1-deb10u2build0.20.04.1",
      "released": "2022-11-02T10:15:00Z"
    },
    {
      "platform": "linux",
      "product": "node-xmldom",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "0.7.5-1ubuntu0.22.04.1",
      "fix": "node-xmldom 0.7.5-1ubuntu0.22.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-node-xmldom-0.7.5-1ubuntu0.22.04.1",
      "released": "2022-11-02T10:15:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}