Skip to content
OpenAdvisories

Package · Debian

node-xmldom

24 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 6.9
    CVE-2026-83611

    xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content

    xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMParser.parseFromString() can silently accept an end tag s…

    xmldom xmldom node-xmldom node-xmldom Debian Ubuntu npm
  • Medium 6.3
    CVE-2026-83610

    xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization

    xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createEntityReference(name) accepts an invalid name…

    xmldom xmldom node-xmldom node-xmldom Debian Ubuntu npm
  • Medium 6.5
    CVE-2021-32796

    Misinterpretation of malicious XML input in xmldom

    xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may l…

    xmldom xmldom node-xmldom node-xmldom Debian Ubuntu npm
  • Medium 4.3
    CVE-2021-21366

    Misinterpretation of malicious XML input

    xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously craf…

    xmldom xmldom node-xmldom node-xmldom Debian Ubuntu npm