Misinterpretation of malicious XML input
Impact
xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents.
This may lead to unexpected syntactic changes during XML processing in some downstream applications.
Patches
Update to 0.5.0 (once it is released)
Workarounds
Downstream applications can validate the input and reject the maliciously crafted documents.
References
Similar to this one reported on the Go standard library:
For more information
If you have any questions or comments about this advisory:
- Open an issue in
xmldom/xmldom - Email us: send an email to all addresses that are shown by
npm owner ls xmldom
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | xmldom | < 0.5.0 | 0.5.0 |
References
- https://github.com/xmldom/xmldom/security/advisories/GHSA-h6q6-9hqw-rwfv
- https://nvd.nist.gov/vuln/detail/CVE-2021-21366
- https://github.com/xmldom/xmldom/commit/d4201b9dfbf760049f457f9f08a3888d48835135
- https://github.com/xmldom/xmldom
- https://github.com/xmldom/xmldom/releases/tag/0.5.0
- https://lists.debian.org/debian-lts-announce/2023/01/msg00000.html
- https://www.npmjs.com/package/xmldom
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N- Weakness (CWE)
CWE-115, CWE-436- Platform
- npm
- Package
xmldom- Disclosed
- 12.03.2021
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-h6q6-9hqw-rwfv - CC BY 4.0
Vulnerability history: xmldom
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 17
- First → latest
- 03.2021 09.2026
- Without a fix
- 16
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 12
- Medium 4
Disclosures per year
- 2021: 2
- 2022: 1
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 14
-
Misinterpretation of malicious XML input this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.