CVE-2022-37616 is a critical prototype pollution vulnerability in the xmldom package (specifically in the copy function within dom.js) affecting versions prior to 0.8.3. This flaw allows an attacker to manipulate object prototypes, potentially leading to denial of service, information disclosure, or arbitrary code execution. With a CVSS score of 9.8 (CRITICAL), it is easily exploitable over a network with low attack complexity and no user interaction required, impacting confidentiality, integrity, and availability. Despite its high severity, there is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 0.6.0CPE matchmatch criteria | cpe:2.3:a:xmldom_project:xmldom:*:*:*:*:*:node.js:*:* | ||
>= 0.7.0, < 0.7.6CPE matchmatch criteria | cpe:2.3:a:xmldom_project:xmldom:*:*:*:*:*:node.js:*:* | ||
>= 0.8.0, < 0.8.3CPE matchmatch criteria | cpe:2.3:a:xmldom_project:xmldom:*:*:*:*:*:node.js:*:* | ||
0.9.0CPE matchmatch criteria | cpe:2.3:a:xmldom_project:xmldom:0.9.0:beta1:*:*:*:node.js:*:* | ||
10.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2022-37616
Jun 11, 2024Withdrawn: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in @xmldom/xmldom and xmldom
Oct 11, 2022A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid"; however some third parties takes the position that "A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted."
Oct 11, 2022