Vulnerability in depencies (xmldom)

[pavelkalin]

Could you please update to version 0.5.0 or later as per https://www.npmjs.com/advisories/1650

Thank you!

[servicesarchitecturemanager]

is this issue exploitable in Clever/saml2

[Chocobozzz]

is this issue exploitable in Clever/saml2

It seems so: https://mattermost.com/blog/securing-xml-implementations-across-the-web/

[rmobis]

As per xmldom/xmldom#271 (and in order to stay safe from a vulnerability in 0.6.0), the recommended now would be to update to @xmldom/xmldom@^0.7.0.

[dbauszus-glx]

Should be resolved once this is merged. #245

There is a xmldom 0.8.0 release. Might be wirth using the latest version now.

[rparpa]

Don't know if it has been already posted elsewhere, but you can fix the vulnerability issue by overriding the used xmldom:

package.json

{
  "dependencies": {
    "saml2-js": "^3.0.1"
  },
  "overrides": {
    "saml2-js": {
      "xmldom": "npm:@xmldom/xmldom@^0.8.3"
    }
  }
}

At the moment, it seems to work fine with this override in my case.

[mcab]

Addressed in #261.