Sign in
Deutsch English Español Polski
Medium

Misinterpretation of malicious XML input

  • Disclosed: 03.08.2021
  • Updated: 11.10.2026 10:22

Impact

xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes during XML processing in some downstream applications.

Patches

Update to one of the fixed versions of @xmldom/xmldom (>=0.7.0)

See issue #271 for the status of publishing xmldom to npm or join #270 for Q&A/discussion until it's resolved.

Workarounds

Downstream applications can validate the input and reject the maliciously crafted documents.

References

Similar to this one reported on the Go standard library:

For more information

If you have any questions or comments about this advisory:

  • Open an issue in xmldom/xmldom
  • Email us: send an email to all addresses that are shown by npm owner ls @xmldom/xmldom

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package xmldom <= 0.6.0 no fix
npm package @xmldom/xmldom < 0.7.0 0.7.0

References

CVSS score 6.5/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness (CWE)
CWE-116
Platform
npm
Package
xmldom, @xmldom/xmldom
Disclosed
03.08.2021
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-5fg8-2547-mr8q - CC BY 4.0

Vulnerability history: @xmldom/xmldom

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (22) in the archive
Total entries
22
First → latest
08.2021 09.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 18
  • Medium 3

Disclosures per year

Severity:
  1. xmldom: Processing Instruction Target Injection Bypasses requireWellFormed
    High CVE-2026-83616 >= 0.7.0, < 0.8.15, >= 0.9.0, < 0.9.12 0.8.15, 0.9.12
  2. xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator
    High CVE-2026-83617 >= 0.9.11, < 0.9.12 0.9.12
  3. xmldom: DocType `name` Injection Bypasses requireWellFormed
    High CVE-2026-83608 >= 0.7.0, < 0.8.15, >= 0.9.0, < 0.9.12 0.8.15, 0.9.12
  4. xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path
    High CVE-2026-83609 >= 0.9.0, < 0.9.12 0.9.12
  5. xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator
    High CVE-2026-83618 >= 0.9.10, < 0.9.12 0.9.12
  6. xmldom: Quadratic-time attribute deduplication
    High CVE-2026-83613 >= 0.7.0, < 0.8.15, >= 0.9.0, < 0.9.12 0.8.15, 0.9.12
  7. xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser
    High CVE-2026-83619 >= 0.7.0, < 0.8.15 0.8.15
  8. xmldom: Quadratic-memory consumption
    High CVE-2026-83615 >= 0.7.0, < 0.8.15, >= 0.9.0, < 0.9.12 0.8.15, 0.9.12
  9. xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge
    High CVE-2026-83614 >= 0.7.0, < 0.8.15, >= 0.9.0, < 0.9.12 0.8.15, 0.9.12
  10. xmldom: HTML raw-text closing-tag case mismatch causes output amplification
    High CVE-2026-83612 >= 0.9.0-beta.1, < 0.9.12 0.9.12
  11. xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions
    High CVE-2026-83606 >= 0.9.0-beta.9, < 0.9.11 0.9.11
  12. xmldom: Element name injection via createElement() bypasses requireWellFormed
    High CVE-2026-83607 >= 0.9.0, < 0.9.11, >= 0.7.0, < 0.8.14 0.9.11, 0.8.14
  13. xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
    High CVE-2026-83605 >= 0.9.0, < 0.9.11, >= 0.7.0, < 0.8.14 0.9.11, 0.8.14
  14. xmldom: Uncontrolled recursion in XML serialization leads to DoS
    High CVE-2026-41673 < 0.8.13, >= 0.9.0, < 0.9.10 0.8.13, 0.9.10
  15. xmldom has XML injection through unvalidated DocumentType serialization
    High CVE-2026-41674 < 0.8.13, >= 0.9.0, < 0.9.10 0.8.13, 0.9.10
  16. xmldom has XML node injection through unvalidated processing instruction serialization
    High CVE-2026-41675 < 0.8.13, >= 0.9.0, < 0.9.10 0.8.13, 0.9.10
  17. xmldom has XML node injection through unvalidated comment serialization
    High CVE-2026-41672 < 0.8.13, >= 0.9.0, < 0.9.10 0.8.13, 0.9.10
  18. xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion
    High · 7.5 CVE-2026-34601 < 0.8.12, >= 0.9.0, < 0.9.9 0.8.12, 0.9.9
  19. xmldom allows multiple root nodes in a DOM
    Critical · 9.8 CVE-2022-39353 < 0.7.7, >= 0.8.0, < 0.8.4, >= 0.9.0-beta.1, < 0.9.0-beta.4 0.7.7, 0.8.4, 0.9.0-beta.4
  20. Misinterpretation of malicious XML input this entry
    Medium · 6.5 CVE-2021-32796 < 0.7.0 0.7.0

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.