Описание
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute() calls the private _createAttribute(name) path without validating the attribute name, while Document.createAttribute(name) validates against QName. XMLSerializer.serializeToString() emits attribute names verbatim, and requireWellFormed: true did not validate them, so a crafted name can terminate the intended attribute and inject additional attributes, including event handlers, into browser-consumed output; synthesized xmlns:PREFIX declarations expose the same unchecked-name boundary. This issue is fixed in @xmldom/xmldom versions 0.8.14 and 0.9.11; no fixed version is available for xmldom.
A flaw was found in xmldom, a JavaScript XML DOM parser. The Element.setAttribute() function does not properly validate attribute names, allowing a remote attacker to inject specially crafted attribute names. This can lead to the injection of additional attributes, including event handlers, into browser-consumed output. Consequently, a remote attacker could achieve client-side script execution, such as Cross-Site Scripting (XSS), in the context of the affected application.
Отчет
This is an Important flaw in xmldom that allows attribute injection, potentially leading to client-side script execution. An attacker could craft malicious XML input that, when processed by an application using xmldom and subsequently rendered in a browser-like environment, could execute arbitrary scripts. This risk is primarily present in applications that handle untrusted XML data and display it to users.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Build of Podman Desktop | rh-podman-desktop.git | Affected | ||
| Red Hat Developer Hub | rhdh/rhdh-hub-rhel9 | Affected | ||
| Red Hat Enterprise Linux 10 | grafana | Affected | ||
| Red Hat Enterprise Linux 8 | grafana | Not affected | ||
| Red Hat Enterprise Linux 9 | grafana | Affected | ||
| Red Hat Fuse 7 | xmldom | Will not fix | ||
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-mlflow-rhel9 | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift4/ose-console | Affected |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
8.1 High
CVSS3
Связанные уязвимости
(xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) ...)
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute() calls the private _createAttribute(name) path without validating the attribute name, while Document.createAttribute(name) validates against QName. XMLSerializer.serializeToString() emits attribute names verbatim, and requireWellFormed: true did not validate them, so a crafted name can terminate the intended attribute and inject additional attributes, including event handlers, into browser-consumed output; synthesized xmlns:PREFIX declarations expose the same unchecked-name boundary. This issue is fixed in @xmldom/xmldom versions 0.8.14 and 0.9.11; no fixed version is available for xmldom.
xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) ...
xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
EPSS
8.1 High
CVSS3