CVE-2022-39353

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` collection of the `Document`, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the `documentElement`or reject a document with a document that has more then 1 `childNode`.

• CWE-20
• CWE-1288
• CWE-20

• https://github.com/jindw/xmldom/issues/150Exploit, Issue Tracking, Third Party Advisory
• https://github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/01/msg00000.htmlMailing List, Third Party Advisory
• https://github.com/jindw/xmldom/issues/150Exploit, Issue Tracking, Third Party Advisory
• https://github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/01/msg00000.htmlMailing List, Third Party Advisory

Published

Nov 2, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39348Twisted is an event-based framework for internet application…5.4
• CVE-2022-39349The Tasks.org Android app is an open-source app for to-do li…5.5
• CVE-2022-3935The Welcart e-Commerce WordPress plugin before 2.8.4 does no…5.4
• CVE-2022-39350@dependencytrack/frontend is a Single Page Application (SPA)…5.4
• CVE-2022-39351Dependency-Track is a Component Analysis platform that allow…4.4
• CVE-2022-39352OpenFGA is a high-performance authorization/permission engin…9.8
• CVE-2022-39354SputnikVM, also called evm, is a Rust implementation of Ethe…7.5
• CVE-2022-39355Discourse Patreon enables syncronization between Discourse G…9.8
• CVE-2022-39356Discourse is a platform for community discussion. Users who …8.8
• CVE-2022-39357Winter is a free, open-source content management system base…9.8
• CVE-2022-39358Metabase is data visualization software. Prior to versions 0…6.5
• CVE-2022-39359Metabase is data visualization software. Prior to versions 0…6.5