[Git][security-tracker-team/security-tracker][master] Add node-xmldom issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
92928578 by Salvatore Bonaccorso at 2026-09-01T22:24:04+02:00
Add node-xmldom issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -130,15 +130,35 @@ CVE-2026-84061 (A security flaw has been discovered in zhongyu09 OpenChatBI up t
 CVE-2026-84059 (A flaw has been found in ICP DAS UA-2200 and UA-5200 up to 20260704. T ...)
 	NOT-FOR-US: ICP DAS UA-2200 and UA-5200
 CVE-2026-83619 (xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core)  ...)
-	TODO: check
+	- node-xmldom 0.9.5-1
+	NOTE: https://github.com/xmldom/xmldom/security/advisories/GHSA-x4fp-j954-r2f4
+	NOTE: https://github.com/xmldom/xmldom/pull/1072
+	NOTE: Fixed by: https://github.com/xmldom/xmldom/commit/3abb0934f5a8a84d83a1f9cde0f2bd04c08b2a09 (0.8.15)
+	NOTE: 0.9.x is not affected by the vulnerability, mark first version in unstable as fixed version
 CVE-2026-83618 (xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core)  ...)
-	TODO: check
+	- node-xmldom <unfixed>
+	NOTE: https://github.com/xmldom/xmldom/security/advisories/GHSA-vr34-hp96-76pp
+	NOTE: https://github.com/xmldom/xmldom/pull/1071
+	NOTE: Fixed by: https://github.com/xmldom/xmldom/commit/7b2ec67e1750daadd0bb06c92e875e726544a362 (0.9.12)
 CVE-2026-83617 (xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core)  ...)
-	TODO: check
+	- node-xmldom <unfixed>
+	NOTE: https://github.com/xmldom/xmldom/security/advisories/GHSA-jxjr-3g7g-3944
+	NOTE: https://github.com/xmldom/xmldom/pull/1071
+	NOTE: Fixed by: https://github.com/xmldom/xmldom/commit/7b2ec67e1750daadd0bb06c92e875e726544a362 (0.9.12)
 CVE-2026-83616 (xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core)  ...)
-	TODO: check
+	- node-xmldom <unfixed>
+	NOTE: https://github.com/xmldom/xmldom/security/advisories/GHSA-c7q8-3ch8-vqpv
+	NOTE: https://github.com/xmldom/xmldom/pull/1071
+	NOTE: https://github.com/xmldom/xmldom/pull/1072
+	NOTE: Fixed by: https://github.com/xmldom/xmldom/commit/1cde3e31a07c41c87cfd368d6946aa477f16b4f9 (0.9.12)
+	NOTE: Fixed by: https://github.com/xmldom/xmldom/commit/3b694872bcb5c7e3cbadba961a4be2488750ce5b (0.8.15)
 CVE-2026-83615 (xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core)  ...)
-	TODO: check
+	- node-xmldom <unfixed>
+	NOTE: https://github.com/xmldom/xmldom/security/advisories/GHSA-965w-775f-mr7g
+	NOTE: https://github.com/xmldom/xmldom/pull/1071
+	NOTE: https://github.com/xmldom/xmldom/pull/1072
+	NOTE: Fixed by: https://github.com/xmldom/xmldom/commit/dabffe884e864eeecb1f515c716f875e1bc47ec1 (0.9.12)
+	NOTE: Fixed by: https://github.com/xmldom/xmldom/commit/954370f58c046223faf95ba77efcbc8ce014409d (0.8.15)
 CVE-2026-83614 (xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core)  ...)
 	TODO: check
 CVE-2026-83613 (xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core)  ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9292857879ef584aa300c88f5847a69b8194c70f

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9292857879ef584aa300c88f5847a69b8194c70f
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260901/7e48593c/attachment-0001.htm>