CVE-2022-37616
Publication date 11 October 2022
Last updated 25 August 2025
Ubuntu priority
Description
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid"; however, some third parties takes the position that "A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted."
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| node-xmldom | ||
| 22.04 LTS jammy |
Fixed 0.7.5-1ubuntu0.22.04.1
|
|
| 20.04 LTS focal |
Fixed 0.1.27+ds-1+deb10u2build0.20.04.1
|
|
| 18.04 LTS bionic | Not in release | |
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release |
Severity score breakdown
CVSS version: CVSS v3.0
Base score
9.8 · Critical
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Related Ubuntu Security Notices (USN)
- USN-6102-1
- xmldom vulnerabilities
- 24 May 2023
Other references
- https://github.com/xmldom/xmldom/blob/bc36efddf9948aba15618f85dc1addfc2ac9d7b2/lib/dom.js#L1
- https://github.com/xmldom/xmldom/blob/bc36efddf9948aba15618f85dc1addfc2ac9d7b2/lib/dom.js#L3
- https://github.com/xmldom/xmldom/pull/437
- https://github.com/xmldom/xmldom/security/advisories/GHSA-9pgh-qqpf-7wqj
- https://www.cve.org/CVERecord?id=CVE-2022-37616