Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid"; however, some third parties takes the position that "A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted."
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 2 products
🔴 @xmldom/xmldom, ReDoS, #CVE-2022-37616 (High) -DC-Sep2026-2261 https://dailycve.com/xmldom-xmldom-redos-cve-2022-37616-high-dc-sep2026-2261/
Post summary
The tweet announces a high‑severity Regular Expression Denial of Service (ReDoS) vulnerability in the xmldom library, citing its CVE ID and severity.
🔴 @xmldom/xmldom, CDATA Injection, #CVE-2022-37616 (Critical) https://dailycve.com/xmldom-xmldom-cdata-injection-cve-2022-37616-critical/
Post summary
The post announces CVE‑2022‑37616 as a critical CDATA Injection flaw, providing a link to a DailyCVE article but no further exploitation details or remediation advice.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | debian | debian_linux | 10.0 | - | - |
| App | xmldom_project | xmldom | - | node.js | - |
| App | xmldom_project | xmldom | 0.9.0 | node.js | - |