Critical vulnerability in `@xmldom/xmldom@0.8.3`

Hello, we have seen a warning via aquasec about a vulnerability in xmldom: https://avd.aquasec.com/nvd/2022/cve-2022-39353/

This is a dependency of @mswjs/interceptors, hopefully we can update xmldom from 0.8.3 to 0.8.4 to remove the issue.

See here: https://github.com/xmldom/xmldom/security/advisories/GHSA-crh6-fp67-6883

[kettanaito]

The interceptors don’t have to be released at all for you to get the fix for the transient dependency of xmldom:

• msw
  • whichever patch version of @mswjs/interceptors
    • whichever patch version of xmldom

—Source

Installing msw gets you xmldom@^0.8.3, which means 0.8.x. The fix is at xmldom@0.8.5, so you will get it per semver. Just make sure you’re not hitting your package manager’s cache when reinstalling (rm -rf node_modules or --force).

[ben-wilson-peak]

For anyone who stumbles on this while looking to patch:

  "resolutions": {
    "msw/**/@mswjs/interceptors": "0.19.0"
  }