CVE-2022-39353: debian debian_linux Improper Input Validation
Vulnerability summary
CVE-2022-39353 is a critical (CVSS 9.8) Improper Input Validation vulnerability in debian debian_linux. EPSS estimates a 1.28% chance of exploitation in the next 30 days, higher than 69.6% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 02-11-2022PublishedVulnerability first disclosed.
- 22-04-2025Last modifiedVulnerability information updated.
Description
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a document that has more then 1 `childNode`.
CVSS metrics
6 scores · 6 sources · 1 version- CVE.orgCNA9.4CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · NpmEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated9.4CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:HDiffers
EPSS trend
Probability
1.28%
Chance of exploitation in the next 30 days
Percentile
70%
Versus all other CVEs
30-day change
+0.01 pp
From 1.27% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundXmldom
Maturity: poc
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-1288Improper Validation of Consistency within InputThe product receives a complex input with multiple elements or fields that must be consistent with each other, but it does not validate or incorrectly validates that the input is actually consistent.
Affected systems
Chainguard2 products
- wazuh-dashboard-security-plugin< 4.14.6-r3
- wazuh-dashboard-security-plugin-fips< 4.14.6-r1
Debian2 products
- node-xmldom< 0.8.6-1
- debian_linuxEOL10.0
@xmldom1 product
- xmldom< 0.7.7 | ≥ 0.8.0, < 0.8.4 | ≥ 0.9.0-beta.1, < 0.9.0-beta.4
Npm1 product
- xmldom≤ 0.6.0
Ubuntu1 product
- node-xmldom< 0.1.27+ds-1+deb10u2build0.20.04.1 | < 0.7.5-1ubuntu0.22.04.1 | All versions (No fix recorded)
Xmldom1 product
- xmldom≤ 0.6.0 | < 0.7.7 | ≥ 0.8.0, < 0.8.4 | ≥ 0.9.0-beta.1, < 0.9.0-beta.4
Xmldom_project1 product
- xmldom< 0.6.0 | ≥ 0.7.0, < 0.7.7 | ≥ 0.8.0, < 0.8.4 | 0.9.0:beta1 | 0.9.0:beta2 | 0.9.0:beta3
7 vendors · 9 products
References
16 links- github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883REPORTWEBAdvisoryThird Party Advisory
lists.debian.org/debian-lts-announce/2023/01/msg00000.htmlMailing ListWEBARTICLEThird Party Advisory
Show all 16 references
- github.com/xmldom/xmldomPACKAGE