PatchTheCVExmldom vulnerabilities and fixes
Recent CVEs affecting xmldom, with upgrade or downgrade steps. 3 tracked.
xmldom has 3 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 3. Most recent: 2022-10-11. Highest priority: CVE-2022-37616 (score 65/100).
- CVE-2022-37616 CRITICAL 9.8 UPGRADE MITIGATE A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/
- CVE-2021-32796 MEDIUM 6.5 UPGRADE xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer
- CVE-2021-21366 MEDIUM 4.3 UPGRADE MITIGATE xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module
FAQ
How do I fix xmldom vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is xmldom being exploited right now?
None of the tracked xmldom CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which xmldom CVE should I patch first?
CVE-2022-37616 currently ranks highest (65/100): A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/.