Withdrawn

This advisory has been withdrawn because the maintainers of @xmldom/xmldom and multiple third parties disputed the validity of the issue. Attempts to create or replicate a proof of concept have been unsuccessful.

Original Description

Impact

A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package.

Patches

Update to @xmldom/xmldom@~0.7.6, @xmldom/xmldom@~0.8.3 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.2 (dist-tag next).

Workarounds

None

References

xmldom/xmldom#437

For more information

If you have any questions or comments about this advisory:

• Email us at security@xmldom.org
• Add information to xmldom/xmldom#436

References

• GHSA-9pgh-qqpf-7wqj
• https://nvd.nist.gov/vuln/detail/CVE-2022-37616
• xmldom/xmldom#436
• xmldom/xmldom#437
• https://github.com/xmldom/xmldom/blob/bc36efddf9948aba15618f85dc1addfc2ac9d7b2/lib/dom.js#L1
• https://github.com/xmldom/xmldom/blob/bc36efddf9948aba15618f85dc1addfc2ac9d7b2/lib/dom.js#L3
• https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md#076
• https://lists.debian.org/debian-lts-announce/2022/10/msg00023.html
• xmldom/xmldom#436 (comment)
• xmldom/xmldom#436 (comment)
• https://dl.acm.org/doi/abs/10.1145/3488932.3497769
• https://dl.acm.org/doi/pdf/10.1145/3488932.3497769
• http://users.encs.concordia.ca/~mmannan/publications/JS-vulnerability-aisaccs2022.pdf