| Package | Affected versions | Patched versions |
|---|---|---|
| xmldom | = 0.9.0≥ 0.7.0, < 0.7.6≥ 0.8.0, < 0.8.3≤ 0.6.0 | 0.7.60.8.3 |
| @xmldom/xmldom | ≥ 0.8.0, < 0.8.3≥ 0.9.0-beta.1, < 0.9.0-beta.2< 0.7.6 | 0.8.30.9.0-beta.20.7.6 |
| xmldom | ≤ 0.6.0 |
This advisory has been withdrawn because the maintainers of @xmldom/xmldom and multiple third parties disputed the validity of the issue. Attempts to create or replicate a proof of concept have been unsuccessful.
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package.
Update to @xmldom/xmldom@~0.7.6, @xmldom/xmldom@~0.8.3 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.2 (dist-tag next).
None
https://github.com/xmldom/xmldom/pull/437
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free