Vulnerabilities

TI-2026-57718 CVE-2026-83619 · GHSA-x4fp-j954-r2f4

xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser

MEDIUM 44

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00524 Published 2026-09-01 Partial fix · 0.8.15 CWE-1333

TI-2026-57717 CVE-2026-83618 · GHSA-vr34-hp96-76pp

xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator

HIGH 79

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0057 Published 2026-09-01 Fixed in 0.9.12 CWE-625

TI-2026-57716 CVE-2026-83617 · GHSA-jxjr-3g7g-3944

xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator

HIGH 77

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0057 Published 2026-09-01 Partial fix · 0.9.12 CWE-625

TI-2026-57715 CVE-2026-83616 · GHSA-c7q8-3ch8-vqpv

xmldom: Processing Instruction Target Injection Bypasses requireWellFormed

HIGH 77

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00612 Published 2026-09-01 Partial fix · 0.8.15, 0.9.12 CWE-91

TI-2026-57714 CVE-2026-83615 · GHSA-965w-775f-mr7g

xmldom: Quadratic-memory consumption

HIGH 77

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0059 Published 2026-09-01 Partial fix · 0.8.15, 0.9.12 CWE-770

TI-2026-57713 CVE-2026-83614 · GHSA-93r5-fhx6-vmg9

Uncontrolled resource consumption in xmldom

MEDIUM 44

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0059 Published 2026-09-01 Partial fix · 0.8.15, 0.9.12 CWE-400

TI-2026-57712 CVE-2026-83613 · GHSA-8344-3jmq-59r6

xmldom: Quadratic-time attribute deduplication

HIGH 77

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00604 Published 2026-09-01 Partial fix · 0.9.12, 0.8.15 CWE-407

TI-2026-57711 CVE-2026-83612 · GHSA-6mj3-qw4j-hgrw

xmldom: HTML raw-text closing-tag case mismatch causes output amplification

HIGH 77

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00524 Published 2026-09-01 Partial fix · 0.9.12 CWE-178

TI-2026-57710 CVE-2026-83611 · GHSA-6h8r-xr42-gp59

xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content

HIGH 70

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00619 Published 2026-09-01 Partial fix · 0.9.12, 0.8.15 CWE-1286

TI-2026-57709 CVE-2026-83610 · GHSA-6gmq-8vp8-gcm6

xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization

HIGH 67

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0059 Published 2026-09-01 Partial fix · 0.8.15, 0.9.12 CWE-116

TI-2026-57708 CVE-2026-83609 · GHSA-3px3-54cx-rmw9

XML injection in xmldom

MEDIUM 44

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00543 Published 2026-09-01 Partial fix · 0.9.12 CWE-625

TI-2026-57707 CVE-2026-83608 · GHSA-27p8-2357-5qqv

xmldom: DocType `name` Injection Bypasses requireWellFormed

HIGH 77

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00612 Published 2026-09-01 Partial fix · 0.9.12, 0.8.15 CWE-91

TI-2026-57706 CVE-2026-83607 · GHSA-w2rr-34g9-rvrj

xmldom: Element name injection via createElement() bypasses requireWellFormed

HIGH 77

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00612 Published 2026-09-01 Partial fix · 0.8.14, 0.9.11 CWE-91

TI-2026-57705 CVE-2026-83606 · GHSA-g53g-w8rj-fmg7

xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions

HIGH 77

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00524 Published 2026-09-01 Fixed in 0.9.11 CWE-1333

TI-2026-57704 CVE-2026-83605 · GHSA-4w3w-2rp5-g8jm

xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

HIGH 77

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00612 Published 2026-09-01 Partial fix · 0.8.14, 0.9.11 CWE-91

TI-2026-30192 CVE-2026-41675 · GHSA-x6wf-f3px-wcqx

xmldom: XML node injection through unvalidated processing instruction serialization

HIGH 77

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0047 Published 2026-05-07 Partial fix · 0.8.13, 0.9.10 CWE-91

TI-2026-30191 CVE-2026-41674 · GHSA-f6ww-3ggp-fr8h

xmldom: XML injection through unvalidated DocumentType serialization

HIGH 77

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00565 Published 2026-05-07 Partial fix · 0.8.13, 0.9.10 CWE-91

TI-2026-30190 CVE-2026-41673 · GHSA-2v35-w6hq-6mfw

xmldom: Denial of service via uncontrolled recursion in XML serialization

HIGH 77

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00643 Published 2026-05-07 Partial fix · 0.8.13, 0.9.10 CWE-674

TI-2026-30189 CVE-2026-41672 · GHSA-j759-j44w-7fr8

xmldom: XML node injection through unvalidated comment serialization

HIGH 77

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00457 Published 2026-05-07 Partial fix · 0.8.13, 0.9.10 CWE-91

TI-2026-26848 CVE-2026-34601 · GHSA-wh4c-j3r5-mjhp

xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion

HIGH 72

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0049 Published 2026-04-02 Fixed in 0.8.12, 0.9.9 CWE-91

TI-2022-18728 CVE-2022-39353 · GHSA-crh6-fp67-6883

xmldom allows multiple root nodes in a DOM

HIGH 81

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01559 Published 2022-11-02 Fixed in 0.7.7, 0.8.4 +1 CWE-1288

TI-2022-17521 CVE-2022-37616

A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom…

MEDIUM 46

A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02134 Published 2022-10-11 No fix listed CWE-1321

TI-2021-12462 CVE-2021-32796 · GHSA-5fg8-2547-mr8q

Misinterpretation of malicious XML input in xmldom

LOW 32

xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01358 Published 2021-07-27 Fixed in 0.7.0 CWE-116

TI-2021-04465 CVE-2021-21366 · GHSA-h6q6-9hqw-rwfv

Misinterpretation of malicious XML input

LOW 23

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.0134 Published 2021-03-12 Fixed in 0.5.0 CWE-115

Vulnerabilities

Filters