@xmldom/xmldom CVE-2026-83616

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. Rated crit

XML injection via EntityReference in xmldom enables attacker-controlled XML markup to escape entity-reference boundaries

A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) pa

Quadratic namespace-map allocation in xmldom's SAX parser allows unauthenticated remote attackers to exhaust the Node.js

Two independent quadratic-complexity denial-of-service paths in the xmldom JavaScript XML parser allow remote unauthenti

XML injection in the xmldom serializer allows a crafted DocumentType.name containing '>' or whitespace to prematurely cl

XML injection and cross-site scripting in the xmldom JavaScript library allows attacker-controlled tag names to be injec

XML injection in the xmldom JavaScript library allows crafted attribute names to break out of attribute context during s

Quadratic attribute-processing complexity in xmldom's DOMParser enables remote unauthenticated denial of service against

XML injection in @xmldom/xmldom versions 0.9.10 and 0.9.11 bypasses the requireWellFormed serializer's DocumentType vali

XML injection in @xmldom/xmldom 0.9.11 allows attackers who supply crafted element or attribute names containing ECMAScr

XML injection in @xmldom/xmldom 0.9.0-0.9.11 allows an attacker to embed malicious markup into serialized XML output by