@xmldom/xmldom
npm23 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting @xmldom/xmldompage 1 of 1
- CVE-2021-32796MEDIUMCVSS 6.5EG 6.5fixed in 0.7.02021-07-27
xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their …
- CVE-2022-37616CRITICALCVSS 9.8EG 9.8fixed in 0.7.6, 0.8.3 or 0.9.0-beta.2, by version range2022-10-11
vulnerable: 0.9.0-beta.1
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this repor…
- CVE-2022-39353CRITICALCVSS 9.4EG 9.4fixed in 0.7.7, 0.8.4 or 0.9.0-beta.4, by version range2022-11-02
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childN…
- CVE-2026-34601HIGHCVSS 7.5EG 7.5fixed in 0.8.12 or 0.9.9, by version range2026-04-02
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9, xmldom/xmldom allows attacker-controlle…
- CVE-2026-41672HIGHCVSS 7.5EG 7.5fixed in 0.8.13 or 0.9.10, by version range2026-05-07
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled …
- CVE-2026-41673HIGHCVSS 7.5EG 7.5fixed in 0.8.13 or 0.9.10, by version range2026-05-07
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, seven recursive traversals in lib/dom.j…
- CVE-2026-41674HIGHCVSS 7.5EG 7.5fixed in 0.8.13 or 0.9.10, by version range2026-05-07
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package serializes DocumentType nod…
- CVE-2026-41675HIGHCVSS 7.5EG 7.5fixed in 0.8.13 or 0.9.10, by version range2026-05-07
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled …
- CVE-2026-83605HIGHCVSS 8.7EG 8.7fixed in 0.9.11 or 0.8.14, by version range2026-09-01
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute() calls the private…
- CVE-2026-83606HIGHCVSS 8.7EG 8.7fixed in 0.9.112026-09-01
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-beta.9 until 0.9.11, the processing-instruction production in lib/grammar.js lets the greedy S+ separator and lazy Char*? …
- CVE-2026-83607HIGHCVSS 8.7EG 8.7fixed in 0.9.11 or 0.8.14, by version range2026-09-01
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElement(tagName) stores a…
- CVE-2026-83608HIGHCVSS 8.7EG 8.7fixed in 0.8.15 or 0.9.12, by version range2026-09-01
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, the DOCUMENT_TYPE_NODE branch in lib/dom…
- CVE-2026-83609HIGHCVSS 8.7EG 8.7fixed in 0.9.122026-09-01
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg() builder in lib/grammar.js compiles the anchored QName_exact validator with the multiline fl…
- CVE-2026-83610MEDIUMCVSS 6.3EG 6.3fixed in 0.8.15 or 0.9.12, by version range2026-09-01
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createEntityReference(name) acc…
- CVE-2026-83611MEDIUMCVSS 6.9EG 6.9fixed in 0.8.15 or 0.9.12, by version range2026-09-01
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMParser.parseFromString() can silently…
- CVE-2026-83612HIGHCVSS 8.7EG 8.7fixed in 0.9.122026-09-01
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-beta.1 until 0.9.12, HTML-mode parsing through DOMParser.parseFromString() mishandles a mixed-case closing tag for the scr…
- CVE-2026-83613HIGHCVSS 8.7EG 8.7fixed in 0.8.15 or 0.9.12, by version range2026-09-01
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMHandler.startElement in lib/dom-parse…
- CVE-2026-83614HIGHCVSS 8.7EG 8.7fixed in 0.8.15 or 0.9.12, by version range2026-09-01
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can c…
- CVE-2026-83615HIGHCVSS 8.7EG 8.7fixed in 0.8.15 or 0.9.12, by version range2026-09-01
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.1.5 through 0.6.0, appendElement in lib/sax.js uses _cop…
- CVE-2026-83616HIGHCVSS 8.7EG 8.7fixed in 0.8.15 or 0.9.12, by version range2026-09-01
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createProcessingInstruction(tar…
- CVE-2026-83617HIGHCVSS 8.7EG 8.7fixed in 0.9.122026-09-01
vulnerable: 0.9.11
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QName_exact expression produ…
- CVE-2026-83618HIGHCVSS 8.7EG 8.7fixed in 0.9.122026-09-01
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.10 until 0.9.12, the requireWellFormed: true serializer validates DocumentType.publicId and DocumentType.systemId with Pubid…
- CVE-2026-83619HIGHCVSS 8.7EG 8.7fixed in 0.8.152026-09-01
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.7.0 until 0.8.15, the release-0.8.x parser in lib/sax.js trims captured end-tag names with the unanchored global expression /[…
Check whether @xmldom/xmldom is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for @xmldom/xmldom CVEs against the assets you own.
Book a Demo →