Description
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid"; however, some third parties takes the position that "A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-xmldom | 0.8.3-1 | — |
| Debian 13 | node-xmldom | 0.8.3-1 | — |
| Debian 12 | node-xmldom | 0.8.3-1 | — |
| Debian 10 | node-xmldom | 0.1.27+ds-1+deb10u1 | DLA-3154-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | node-xmldom | 0.7.5-1ubuntu0.22.04.1 | USN-6102-1 |
| Ubuntu 20.04 LTS | node-xmldom | 0.1.27+ds-1+deb10u2build0.20.04.1 | USN-6102-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-tensorboard | 2.16.2-1 | — |
Advisories 4
- WID-SEC-2023-1350 Splunk Splunk Enterprise: Mehrere Schwachstellen in Komponenten von Drittanbietern BSI CERT-Bund (WID) · Jul 1, 2026
- USN-6102-1 node-xmldom vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DLA-3154-1 node-xmldom - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2022-2368 HCL BigFix: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 9, 2023
References
- https://github.com/xmldom/xmldom/blob/bc36efddf9948aba15618f85dc1addfc2ac9d7b2/lib/dom.js#L1
- https://github.com/xmldom/xmldom/blob/bc36efddf9948aba15618f85dc1addfc2ac9d7b2/lib/dom.js#L3
- https://github.com/xmldom/xmldom/issues/436
- https://github.com/xmldom/xmldom/security/advisories/GHSA-9pgh-qqpf-7wqj
- [debian-lts-announce] 20221018 [SECURITY] [DLA 3154-1] node-xmldom security update mailing-list
- https://dl.acm.org/doi/abs/10.1145/3488932.3497769
- https://dl.acm.org/doi/pdf/10.1145/3488932.3497769
- http://users.encs.concordia.ca/~mmannan/publications/JS-vulnerability-aisaccs2022.pdf
- https://github.com/xmldom/xmldom/issues/436#issuecomment-1319412826
- https://github.com/xmldom/xmldom/issues/436#issuecomment-1327776560