You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid"; however, some third parties takes the position that "A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted."
mend-for-github-combot
changed the title
CVE-2022-37616 (Medium) detected in xmldom-0.7.5.tgz
CVE-2022-37616 (High) detected in xmldom-0.7.5.tgz
Oct 12, 2022
CVE-2022-37616 - High Severity Vulnerability
A pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.
Library home page: https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.7.5.tgz
Dependency Hierarchy:
Found in base branch: master
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid"; however, some third parties takes the position that "A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted."
Publish Date: 2022-10-11
URL: CVE-2022-37616
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37616
Release Date: 2022-10-11
Fix Resolution (@xmldom/xmldom): 0.7.6
Direct dependency fix Resolution (soap): 0.39.0
The text was updated successfully, but these errors were encountered: