CPE Details
xmldom Project xmldom 0.6.0 for Node.js
0.6.0
2022-10-27
12h52 +00:00
12h52 +00:00
2022-10-27
13h16 +00:00
13h16 +00:00
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
CPE Name: cpe:2.3:a:xmldom_project:xmldom:0.6.0:-:*:*:*:node.js:*:*
Informations
Vendor
xmldom_projectProduct
xmldomVersion
0.6.0Update
-Target Software
node.jsRelated CVE
| CVE ID | Publié | Description | Score | Gravité |
|---|---|---|---|---|
| A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid"; however, some third parties takes the position that "A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted." | 9.8 |
Critique |
||
| xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This issue has been resolved in version 0.7.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents. | 6.5 |
Moyen |
