{"id":"GHSA-9pgh-qqpf-7wqj","summary":"Withdrawn: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in @xmldom/xmldom and xmldom","details":"## Withdrawn\n\nThis advisory has been withdrawn because the maintainers of `@xmldom/xmldom` and multiple third parties disputed the validity of the issue. Attempts to create or replicate a proof of concept have been unsuccessful.\n\n## Original Description\n\n### Impact\nA prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package.\n\n### Patches\nUpdate to `@xmldom/xmldom@~0.7.6`, `@xmldom/xmldom@~0.8.3` (dist-tag `latest`) or `@xmldom/xmldom@\u003e=0.9.0-beta.2` (dist-tag `next`).\n\n### Workarounds\nNone\n\n### References\nhttps://github.com/xmldom/xmldom/pull/437\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at security@xmldom.org\n* Add information to https://github.com/xmldom/xmldom/issues/436\n","aliases":["CVE-2022-37616"],"modified":"2026-07-08T06:50:34.432900Z","published":"2022-10-11T20:42:57Z","withdrawn":"2022-11-08T19:35:06Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2022-10-11T20:42:57Z","nvd_published_at":"2022-10-11T05:15:00Z","cwe_ids":["CWE-1321"],"severity":"CRITICAL"},"references":[{"type":"WEB","url":"https://github.com/xmldom/xmldom/security/advisories/GHSA-9pgh-qqpf-7wqj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-37616"},{"type":"WEB","url":"https://github.com/xmldom/xmldom/issues/436"},{"type":"WEB","url":"https://github.com/xmldom/xmldom/issues/436#issuecomment-1319412826"},{"type":"WEB","url":"https://github.com/xmldom/xmldom/issues/436#issuecomment-1327776560"},{"type":"WEB","url":"https://github.com/xmldom/xmldom/pull/437"},{"type":"WEB","url":"https://dl.acm.org/doi/abs/10.1145/3488932.3497769"},{"type":"WEB","url":"https://dl.acm.org/doi/pdf/10.1145/3488932.3497769"},{"type":"PACKAGE","url":"https://github.com/xmldom/xmldom"},{"type":"WEB","url":"https://github.com/xmldom/xmldom/blob/bc36efddf9948aba15618f85dc1addfc2ac9d7b2/lib/dom.js#L1"},{"type":"WEB","url":"https://github.com/xmldom/xmldom/blob/bc36efddf9948aba15618f85dc1addfc2ac9d7b2/lib/dom.js#L3"},{"type":"WEB","url":"https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md#076"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2022/10/msg00023.html"},{"type":"WEB","url":"http://users.encs.concordia.ca/~mmannan/publications/JS-vulnerability-aisaccs2022.pdf"}],"affected":[{"package":{"name":"@xmldom/xmldom","ecosystem":"npm","purl":"pkg:npm/%40xmldom/xmldom"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.8.0"},{"fixed":"0.8.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-9pgh-qqpf-7wqj/GHSA-9pgh-qqpf-7wqj.json"}},{"package":{"name":"xmldom","ecosystem":"npm","purl":"pkg:npm/xmldom"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"0.6.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-9pgh-qqpf-7wqj/GHSA-9pgh-qqpf-7wqj.json"}},{"package":{"name":"@xmldom/xmldom","ecosystem":"npm","purl":"pkg:npm/%40xmldom/xmldom"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.9.0-beta.1"},{"fixed":"0.9.0-beta.2"}]}],"versions":["0.9.0-beta.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-9pgh-qqpf-7wqj/GHSA-9pgh-qqpf-7wqj.json"}},{"package":{"name":"@xmldom/xmldom","ecosystem":"npm","purl":"pkg:npm/%40xmldom/xmldom"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.7.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-9pgh-qqpf-7wqj/GHSA-9pgh-qqpf-7wqj.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}