Read the docs
TI-2021-12462 Aliases CVE-2021-32796GHSA-5fg8-2547-mr8q

Misinterpretation of malicious XML input in xmldom

Priority LOW 32CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This issue has been resolved in version 0.7.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.

Why it matters now

EPSS 0.01358 71st percentileScored 2026-11-07
Fix Fixed xmldom (xmldom): 0.7.0@xmldom/xmldom (npm): 0.7.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
xmldomxmldombefore 0.7.00.7.0Patch availableCNA
—xmldom (npm)up to 0.6.0—No fix listedGHSA-5fg8-2547-mr8q
—@xmldom/xmldom (npm)before 0.7.00.7.0Patch availableGHSA-5fg8-2547-mr8q
  • xmldom Vendorxmldom Affected before 0.7.0 Fixed in 0.7.0 Patch available CNA
  • xmldom (npm) Vendor— Affected up to 0.6.0 Fixed in — No fix listed GHSA-5fg8-2547-mr8q
  • @xmldom/xmldom (npm) Vendor— Affected before 0.7.0 Fixed in 0.7.0 Patch available GHSA-5fg8-2547-mr8q

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:xmldom_project:xmldom:*:*:*:*:*:node.js:*:*before 0.7.0Vulnerablexmldom
  • cpe:2.3:a:xmldom_project:xmldom:*:*:*:*:*:node.js:*:* Versions before 0.7.0 Vulnerable ·xmldom

Remediation

  • Fix · CNA xmldom (xmldom) Fixed in 0.7.0
  • Fix · GHSA-5fg8-2547-mr8q @xmldom/xmldom (npm) Fixed in 0.7.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 2 products
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Fuse 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-32796
  2. 2026-10-03 Alias added: GHSA-5fg8-2547-mr8q

References

Patch 1

Advisory 3

Other 4

  • TI-2022-18728 xmldom allows multiple root nodes in a DOM CVSS 3.1CRITICAL 9.8
  • TI-2022-17521 A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom… CVSS 3.1CRITICAL 9.8
  • TI-2021-04465 Misinterpretation of malicious XML input CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences