Read the docs
TI-2021-04465 Aliases CVE-2021-21366GHSA-h6q6-9hqw-rwfv

Misinterpretation of malicious XML input

Priority LOW 23CWE-115Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This is fixed in version 0.5.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.

Why it matters now

EPSS 0.0134 71st percentileScored 2026-11-07
Fix Fixed xmldom (xmldom): 0.5.0xmldom (npm): 0.5.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
xmldomxmldombefore 0.5.00.5.0Patch availableCNA
—xmldom (npm)before 0.5.00.5.0Patch availableGHSA-h6q6-9hqw-rwfv
  • xmldom Vendorxmldom Affected before 0.5.0 Fixed in 0.5.0 Patch available CNA
  • xmldom (npm) Vendor— Affected before 0.5.0 Fixed in 0.5.0 Patch available GHSA-h6q6-9hqw-rwfv

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:xmldom_project:xmldom:*:*:*:*:*:node.js:*:*before 0.5.0Vulnerablexmldom
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:xmldom_project:xmldom:*:*:*:*:*:node.js:*:* Versions before 0.5.0 Vulnerable ·xmldom
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

  • Fix · CNA xmldom (xmldom) Fixed in 0.5.0
  • Fix · GHSA-h6q6-9hqw-rwfv xmldom (npm) Fixed in 0.5.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 2 products
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21366
  2. 2026-10-03 Alias added: GHSA-h6q6-9hqw-rwfv

References

Patch 1

Advisory 3

Other 3

  • TI-2022-18728 xmldom allows multiple root nodes in a DOM CVSS 3.1CRITICAL 9.8
  • TI-2022-17521 A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom… CVSS 3.1CRITICAL 9.8
  • TI-2021-12462 Misinterpretation of malicious XML input in xmldom CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences