CVE-2022-37616: 
CBL Mariner vulnerability analysis and mitigation

A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before version 0.8.3. The vulnerability affects versions = 0.9.0-beta.1 <0.7.6 >= 0.8.0, < 0.8.3 of @xmldom/xmldom and <= 0.6.0 of xmldom (GHSA Advisory).

The vulnerability exists in the copy function within dom.js file of the xmldom package. However, attempts to provide an exploit were unsuccessful and the issue was in process of being marked as invalid. The vulnerability was assigned CVE-2022-37616 and classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes) with a Low severity rating (GHSA Advisory).

If exploited, the vulnerability could potentially allow an attacker to cause unexpected syntactic changes during XML processing. However, the actual impact appears to be limited as attempts to exploit the vulnerability were unsuccessful (Ubuntu Notice).

Users should update to patched versions: @xmldom/xmldom@~0.7.6, @xmldom/xmldom@~0.8.3 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.2 (dist-tag next). No alternative workarounds are available (GHSA Advisory).