-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability report explicitly identifies the 'copy' function in dom.js as the source of prototype pollution. The function iterates over all enumerable properties (including prototype chain properties) via 'for (var p in src)' without hasOwnProperty checks. The fix in PR #437 added hasOwnProperty checks to prevent this, confirming the vulnerability. The code snippets from dom.js show the unpatched version of this function, and multiple advisories reference this as the root cause.
JavaScriptJavaScript| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| xmldom | npm | <= 0.6.0 | |
| @xmldom/xmldom | npm | = 0.9.0-beta.1 | 0.9.0-beta.2 |
| @xmldom/xmldom | npm | >= 0.8.0, < 0.8.3 | 0.8.3 |
| @xmldom/xmldom | npm | < 0.7.6 | 0.7.6 |
Ongoing coverage of React2Shell