Security
فارسی
All products

@xmldom/xmldom

npm · Package
22 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serializationCVE-2026-83610 · GHSA-6GMQ-8VP8-GCM6 @xmldom/xmldomxmldom npmRed Hat Medium Fix reported
xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertionCVE-2026-34601 · GHSA-WH4C-J3R5-MJHP @xmldom/xmldomxmldom npm High Fix reported
xmldom has XML node injection through unvalidated comment serializationCVE-2026-41672 · GHSA-J759-J44W-7FR8 @xmldom/xmldomxmldom npmRed Hat High Fix reported
xmldom has XML injection through unvalidated DocumentType serializationCVE-2026-41674 · GHSA-F6WW-3GGP-FR8H @xmldom/xmldomxmldom npmRed Hat High Fix reported
xmldom has XML node injection through unvalidated processing instruction serializationCVE-2026-41675 · GHSA-X6WF-F3PX-WCQX @xmldom/xmldomxmldom npmRed Hat High Fix reported
xmldom: Uncontrolled recursion in XML serialization leads to DoSCVE-2026-41673 · GHSA-2V35-W6HQ-6MFW @xmldom/xmldomxmldom npmRed Hat High Fix reported
xmldom allows multiple root nodes in a DOMCVE-2022-39353 · GHSA-CRH6-FP67-6883 @xmldom/xmldomxmldom npm Critical Fix reported
Misinterpretation of malicious XML inputCVE-2021-32796 · GHSA-5FG8-2547-MR8Q @xmldom/xmldomxmldom npm Medium Fix reported
xmldom: Quadratic-time attribute deduplicationCVE-2026-83613 · GHSA-8344-3JMQ-59R6 @xmldom/xmldomxmldom npmRed Hat High Fix reported
xmldom: Processing Instruction Target Injection Bypasses requireWellFormedCVE-2026-83616 · GHSA-C7Q8-3CH8-VQPV @xmldom/xmldomxmldom npmRed Hat High Fix reported
xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminatorCVE-2026-83617 · GHSA-JXJR-3G7G-3944 @xmldom/xmldomRed Hat Fuse 7/xmldom npmRed Hat High Fix reported
xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminatorCVE-2026-83618 · GHSA-VR34-HP96-76PP @xmldom/xmldom npm High Fix reported
xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parserCVE-2026-83619 · GHSA-X4FP-J954-R2F4 @xmldom/xmldomRed Hat Build of Podman Desktop/rh-podman-desktop.git npmRed Hat High Fix reported
xmldom: Quadratic-memory consumptionCVE-2026-83615 · GHSA-965W-775F-MR7G @xmldom/xmldomxmldom npmRed Hat High Fix reported
xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text mergeCVE-2026-83614 · GHSA-93R5-FHX6-VMG9 @xmldom/xmldomxmldom npmRed Hat High Fix reported
xmldom: DocType `name` Injection Bypasses requireWellFormedCVE-2026-83608 · GHSA-27P8-2357-5QQV @xmldom/xmldomxmldom npmRed Hat High Fix reported
xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization pathCVE-2026-83609 · GHSA-3PX3-54CX-RMW9 @xmldom/xmldomRed Hat Build of Podman Desktop/rh-podman-desktop.git npmRed Hat High Fix reported
xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing contentCVE-2026-83611 · GHSA-6H8R-XR42-GP59 @xmldom/xmldomxmldom npmRed Hat Medium Fix reported
xmldom: HTML raw-text closing-tag case mismatch causes output amplificationCVE-2026-83612 · GHSA-6MJ3-QW4J-HGRW @xmldom/xmldomRed Hat OpenShift Container Platform 4/openshift4/ose-console npmRed Hat High Fix reported
xmldom: Element name injection via createElement() bypasses requireWellFormedCVE-2026-83607 · GHSA-W2RR-34G9-RVRJ @xmldom/xmldomxmldom npmRed Hat High Fix reported