xmldom

Records24All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high18CVSS 7.0–8.9

Exploited now

xmldom records in CISA KEV

No xmldom vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Xmldom 4 records HIGH

Records

24 records

TI-2022-18728 CVE-2022-39353 · GHSA-crh6-fp67-6883

xmldom allows multiple root nodes in a DOM

HIGH 81

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01559 Published 2022-11-02 Fixed in 0.7.7, 0.8.4 +1 CWE-1288

TI-2026-57717 CVE-2026-83618 · GHSA-vr34-hp96-76pp

xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator

HIGH 79

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0057 Published 2026-09-01 Fixed in 0.9.12 CWE-625

TI-2026-57716 CVE-2026-83617 · GHSA-jxjr-3g7g-3944

xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator

HIGH 77

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0057 Published 2026-09-01 Partial fix · 0.9.12 CWE-625

TI-2026-57715 CVE-2026-83616 · GHSA-c7q8-3ch8-vqpv

xmldom: Processing Instruction Target Injection Bypasses requireWellFormed

HIGH 77

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00612 Published 2026-09-01 Partial fix · 0.8.15, 0.9.12 CWE-91

TI-2026-57714 CVE-2026-83615 · GHSA-965w-775f-mr7g

xmldom: Quadratic-memory consumption

HIGH 77

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0059 Published 2026-09-01 Partial fix · 0.8.15, 0.9.12 CWE-770

TI-2026-57712 CVE-2026-83613 · GHSA-8344-3jmq-59r6

xmldom: Quadratic-time attribute deduplication

HIGH 77

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00604 Published 2026-09-01 Partial fix · 0.9.12, 0.8.15 CWE-407

TI-2026-57711 CVE-2026-83612 · GHSA-6mj3-qw4j-hgrw

xmldom: HTML raw-text closing-tag case mismatch causes output amplification

HIGH 77

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00524 Published 2026-09-01 Partial fix · 0.9.12 CWE-178

TI-2026-57707 CVE-2026-83608 · GHSA-27p8-2357-5qqv

xmldom: DocType `name` Injection Bypasses requireWellFormed

HIGH 77

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00612 Published 2026-09-01 Partial fix · 0.9.12, 0.8.15 CWE-91

TI-2026-57706 CVE-2026-83607 · GHSA-w2rr-34g9-rvrj

xmldom: Element name injection via createElement() bypasses requireWellFormed

HIGH 77

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00612 Published 2026-09-01 Partial fix · 0.8.14, 0.9.11 CWE-91

TI-2026-57705 CVE-2026-83606 · GHSA-g53g-w8rj-fmg7

xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions

HIGH 77

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00524 Published 2026-09-01 Fixed in 0.9.11 CWE-1333

TI-2026-57704 CVE-2026-83605 · GHSA-4w3w-2rp5-g8jm

xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

HIGH 77

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00612 Published 2026-09-01 Partial fix · 0.8.14, 0.9.11 CWE-91

TI-2026-30192 CVE-2026-41675 · GHSA-x6wf-f3px-wcqx

xmldom: XML node injection through unvalidated processing instruction serialization

HIGH 77

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0047 Published 2026-05-07 Partial fix · 0.8.13, 0.9.10 CWE-91

TI-2026-30191 CVE-2026-41674 · GHSA-f6ww-3ggp-fr8h

xmldom: XML injection through unvalidated DocumentType serialization

HIGH 77

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00565 Published 2026-05-07 Partial fix · 0.8.13, 0.9.10 CWE-91

TI-2026-30190 CVE-2026-41673 · GHSA-2v35-w6hq-6mfw

xmldom: Denial of service via uncontrolled recursion in XML serialization

HIGH 77

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00643 Published 2026-05-07 Partial fix · 0.8.13, 0.9.10 CWE-674

TI-2026-30189 CVE-2026-41672 · GHSA-j759-j44w-7fr8

xmldom: XML node injection through unvalidated comment serialization

HIGH 77

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00457 Published 2026-05-07 Partial fix · 0.8.13, 0.9.10 CWE-91

TI-2026-26848 CVE-2026-34601 · GHSA-wh4c-j3r5-mjhp

xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion

HIGH 72

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0049 Published 2026-04-02 Fixed in 0.8.12, 0.9.9 CWE-91

TI-2026-57710 CVE-2026-83611 · GHSA-6h8r-xr42-gp59

xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content

HIGH 70

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00619 Published 2026-09-01 Partial fix · 0.9.12, 0.8.15 CWE-1286

TI-2026-57709 CVE-2026-83610 · GHSA-6gmq-8vp8-gcm6

xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization

HIGH 67

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0059 Published 2026-09-01 Partial fix · 0.8.15, 0.9.12 CWE-116

TI-2022-17521 CVE-2022-37616

A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom…

MEDIUM 46

A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02134 Published 2022-10-11 No fix listed CWE-1321

TI-2026-57718 CVE-2026-83619 · GHSA-x4fp-j954-r2f4

xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser

MEDIUM 44

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00524 Published 2026-09-01 Partial fix · 0.8.15 CWE-1333

TI-2026-57713 CVE-2026-83614 · GHSA-93r5-fhx6-vmg9

Uncontrolled resource consumption in xmldom

MEDIUM 44

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0059 Published 2026-09-01 Partial fix · 0.8.15, 0.9.12 CWE-400

TI-2026-57708 CVE-2026-83609 · GHSA-3px3-54cx-rmw9

XML injection in xmldom

MEDIUM 44

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00543 Published 2026-09-01 Partial fix · 0.9.12 CWE-625

TI-2021-12462 CVE-2021-32796 · GHSA-5fg8-2547-mr8q

Misinterpretation of malicious XML input in xmldom

LOW 32

xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01358 Published 2021-07-27 Fixed in 0.7.0 CWE-116

TI-2021-04465 CVE-2021-21366 · GHSA-h6q6-9hqw-rwfv

Misinterpretation of malicious XML input

LOW 23

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.0134 Published 2021-03-12 Fixed in 0.5.0 CWE-115

Open these records in search →

Critical	2
High	18
Medium	4
Low	0
No CVSS	0