Security
فارسی
All products

xmldom

npm · Package
17 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serializationCVE-2026-83610 · GHSA-6GMQ-8VP8-GCM6 @xmldom/xmldomxmldom npmRed Hat Medium Fix reported
xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertionCVE-2026-34601 · GHSA-WH4C-J3R5-MJHP @xmldom/xmldomxmldom npm High Fix reported
xmldom has XML node injection through unvalidated comment serializationCVE-2026-41672 · GHSA-J759-J44W-7FR8 @xmldom/xmldomxmldom npmRed Hat High Fix reported
xmldom has XML injection through unvalidated DocumentType serializationCVE-2026-41674 · GHSA-F6WW-3GGP-FR8H @xmldom/xmldomxmldom npmRed Hat High Fix reported
xmldom has XML node injection through unvalidated processing instruction serializationCVE-2026-41675 · GHSA-X6WF-F3PX-WCQX @xmldom/xmldomxmldom npmRed Hat High Fix reported
xmldom: Uncontrolled recursion in XML serialization leads to DoSCVE-2026-41673 · GHSA-2V35-W6HQ-6MFW @xmldom/xmldomxmldom npmRed Hat High Fix reported
xmldom allows multiple root nodes in a DOMCVE-2022-39353 · GHSA-CRH6-FP67-6883 @xmldom/xmldomxmldom npm Critical Fix reported
Misinterpretation of malicious XML inputCVE-2021-32796 · GHSA-5FG8-2547-MR8Q @xmldom/xmldomxmldom npm Medium Fix reported
Misinterpretation of malicious XML inputCVE-2021-21366 · GHSA-H6Q6-9HQW-RWFV xmldom npm Medium Fix reported
xmldom: Quadratic-time attribute deduplicationCVE-2026-83613 · GHSA-8344-3JMQ-59R6 @xmldom/xmldomxmldom npmRed Hat High Fix reported
xmldom: Processing Instruction Target Injection Bypasses requireWellFormedCVE-2026-83616 · GHSA-C7Q8-3CH8-VQPV @xmldom/xmldomxmldom npmRed Hat High Fix reported
xmldom: Quadratic-memory consumptionCVE-2026-83615 · GHSA-965W-775F-MR7G @xmldom/xmldomxmldom npmRed Hat High Fix reported
xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text mergeCVE-2026-83614 · GHSA-93R5-FHX6-VMG9 @xmldom/xmldomxmldom npmRed Hat High Fix reported
xmldom: DocType `name` Injection Bypasses requireWellFormedCVE-2026-83608 · GHSA-27P8-2357-5QQV @xmldom/xmldomxmldom npmRed Hat High Fix reported
xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing contentCVE-2026-83611 · GHSA-6H8R-XR42-GP59 @xmldom/xmldomxmldom npmRed Hat Medium Fix reported
xmldom: Element name injection via createElement() bypasses requireWellFormedCVE-2026-83607 · GHSA-W2RR-34G9-RVRJ @xmldom/xmldomxmldom npmRed Hat High Fix reported
xmldom: Attribute name injection via setAttribute() bypasses requireWellFormedCVE-2026-83605 · GHSA-4W3W-2RP5-G8JM @xmldom/xmldomxmldom npmRed Hat High Fix reported