Xmldom
Monthly
ReDoS in @xmldom/xmldom versions 0.7.0 through 0.8.14 allows remote unauthenticated attackers to stall the Node.js event loop by submitting a small crafted XML document containing a malformed end tag. The SAX parser in lib/sax.js uses an unanchored global regex /[ \t\n\r]+$/g to trim end-tag names; a tag with N whitespace characters followed by one non-whitespace character causes the engine to retry the match from every character position with O(N) backtracking per position, yielding O(N²) total work that blocks the single-threaded event loop. No public exploit code or CISA KEV listing is identified at time of analysis, but the CVSS 4.0 score of 8.7 with VA:H and PR:N reflects the severity of unauthenticated, network-reachable availability impact.
XML injection in @xmldom/xmldom versions 0.9.10 and 0.9.11 bypasses the requireWellFormed serializer's DocumentType validation due to a multiline-flag inheritance bug in the PubidLiteral and SystemLiteral regex matchers: a publicId or systemId whose first line is a valid literal passes the check while ECMAScript line terminators (U+000A, U+000D, U+2028, U+2029) and breakout markup on subsequent lines are emitted verbatim into the <!DOCTYPE ...> declaration. This is a bypass of the mitigation introduced for the earlier DocumentType injection advisory; applications that treat requireWellFormed: true as a serialization-time security boundary against DOCTYPE injection are directly exposed. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 0.9.12.
XML injection in @xmldom/xmldom 0.9.11 allows attackers who supply crafted element or attribute names containing ECMAScript line terminators (U+000A, U+000D, U+2028, U+2029) to bypass the requireWellFormed: true serialization guard and emit arbitrary markup verbatim into serialized XML output. The bypass exploits the multiline flag inherited by the QName_exact regex in lib/grammar.js, which causes the anchors to match at line boundaries rather than string boundaries - directly circumventing the strict-name validation introduced to close earlier injection advisories. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Processing-instruction target injection in the @xmldom/xmldom JavaScript library allows XML structure breakout through unvalidated characters in Document.createProcessingInstruction() targets. Versions prior to 0.8.15 and 0.9.12 - and all versions of the legacy xmldom package (0.6.0 and earlier, which has no fix) - emit malformed processing instructions when a target contains >, ?, whitespace, or other XML-Name-invalid characters, enabling injection of arbitrary XML structure into the serialized output. No public exploit has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog.
Quadratic namespace-map allocation in xmldom's SAX parser allows unauthenticated remote attackers to exhaust the Node.js process heap by sending a compact, crafted XML document with repeated namespace prefix declarations. The unmaintained legacy `xmldom` package (versions 0.1.5-0.6.0) has no available fix, while `@xmldom/xmldom` is patched in releases 0.8.15 and 0.9.12. No public exploit has been identified at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates the attack is trivially automatable against any application that parses untrusted XML with this library.
Two independent quadratic-complexity denial-of-service paths in the xmldom JavaScript XML parser allow remote unauthenticated callers to exhaust CPU and memory by submitting crafted XML. The `@xmldom/xmldom` package before versions 0.8.15 and 0.9.12, and all versions of the legacy `xmldom` package (0.3.0-0.6.0), expose both paths through the default `DOMParser.parseFromString()` interface, requiring no authentication or special configuration. No public exploit has been identified at time of analysis, but the security advisories and fix commits are publicly available on GitHub.
Quadratic attribute-processing complexity in xmldom's DOMParser enables remote unauthenticated denial of service against any Node.js application that parses externally supplied XML. When a well-formed XML element contains many distinct attributes, DOMHandler.startElement repeatedly calls NamedNodeMap.setNamedItem, which in turn performs a full linear scan of previously inserted attributes on each insertion - producing O(N²) comparisons for N attributes and stalling the Node.js event loop before any application-level validation can execute. @xmldom/xmldom 0.8.15 and 0.9.12 contain the fix; the legacy xmldom package (≤0.6.0) has no patch and will not receive one. No public exploit has been identified at time of analysis, though the attack is trivially constructable from the published advisory alone.
Quadratic CPU and memory exhaustion in @xmldom/xmldom 0.9.0-beta.1 through 0.9.11 allows denial-of-service via small crafted HTML documents passed to DOMParser.parseFromString(). The parseHtmlSpecialContent function uses a case-sensitive indexOf() to locate closing tags for raw-text elements; when a mixed-case tag like </ScRiPt> is not found, indexOf() returns -1, and the subsequent substring(-1) call destabilizes parser progression and triggers O(N²) output amplification. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, but the attack is unauthenticated and requires no access complexity beyond supplying crafted HTML to the parser.
Silent acceptance of malformed XML end tags in xmldom's DOMParser allows crafted input to bypass parse-before-trust well-formedness gates in security-sensitive Node.js applications. The flaw affects @xmldom/xmldom prior to 0.8.15 and 0.9.12, as well as all versions of the legacy xmldom package (0.6.0 and earlier), for which no patch exists. No public exploit has been identified at time of analysis, but the parser differential is exploitable in any pipeline - SAML processors, XML signature verifiers, API validators - that treats a clean xmldom parse as a validity certificate.
XML injection via EntityReference in xmldom enables attacker-controlled XML markup to escape entity-reference boundaries when the serialized output is reparsed downstream. Applications using @xmldom/xmldom prior to 0.8.15 or 0.9.12, or any version of the legacy xmldom package (which has no fix), are affected if they explicitly call Document.createEntityReference() with attacker-supplied input and serialize the result via XMLSerializer.serializeToString(). No active exploitation is confirmed and no public exploit has been identified; the attack requires an uncommon and explicit application code pattern that the xmldom parser itself never exercises internally.
XML injection in @xmldom/xmldom 0.9.0-0.9.11 allows an attacker to embed malicious markup into serialized XML output by supplying element or attribute names containing ECMAScript line terminators (U+000A, U+000D, U+2028, U+2029). The QName_exact regex in lib/grammar.js is compiled with JavaScript's multiline flag, causing the ^ and $ anchors to match per-line rather than over the full string - a name whose first line is a valid QName passes validation while subsequent lines carry injected markup, bypassing both the default serialization path and requireWellFormed: true. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with no prerequisites reflects the high-integrity impact when an application passes attacker-controlled input to createElementNS, createAttributeNS, createDocumentType, or createAttribute.
XML injection in the xmldom serializer allows a crafted DocumentType.name containing '>' or whitespace to prematurely close the <!DOCTYPE ...> declaration and inject arbitrary sibling markup into serialized XML output. The gap exists because XMLSerializer.serializeToString() under requireWellFormed: true validates publicId, systemId, and internalSubset but emits DocumentType.name verbatim, violating the XML Name production consistently enforced for the other fields. Affected packages are @xmldom/xmldom prior to 0.8.15 and 0.9.12, and all versions of the legacy unscoped xmldom (0.6.0 and earlier) for which no vendor-released fix will be issued; no public exploit code or CISA KEV listing has been identified at time of analysis.
XML injection and cross-site scripting in the xmldom JavaScript library allows attacker-controlled tag names to be injected verbatim into serialized XML or HTML output. Applications using @xmldom/xmldom prior to 0.8.14 or 0.9.11, or the legacy xmldom package at any version, are affected when they pass externally-supplied strings to Document.createElement() and then serialize the resulting DOM with XMLSerializer.serializeToString(). The serializer's requireWellFormed: true path failed to validate element qualified names and synthesized xmlns:PREFIX declarations against the XML QName production, meaning malformed names containing characters such as '>' or '<' pass through unchecked and cause XSS when the output is rendered in a browser. No public exploit has been identified at time of analysis, though the GitHub security advisory and PR diffs include explicit test cases demonstrating injection payloads.
Quadratic regex backtracking in @xmldom/xmldom versions 0.9.0-beta.9 through 0.9.10 allows unauthenticated remote attackers to stall the Node.js event loop by supplying a small malformed XML document containing an unterminated processing instruction with a long whitespace tail. The flaw resides in the processing-instruction production regex in lib/grammar.js, where the greedy S+ separator and lazy Char*? data group endlessly repartition whitespace when the required closing ?> is absent, causing O(n²) backtracking in both parsePI and parseProcessingInstruction. No public exploit has been identified at time of analysis, but the fix commit and GitHub Security Advisory GHSA-g53g-w8rj-fmg7 fully document the vulnerable code path, making independent reproduction straightforward. Vendor-released patch: 0.9.11.
XML injection in the xmldom JavaScript library allows crafted attribute names to break out of attribute context during serialization, enabling injection of arbitrary attributes — including event handlers — into browser-consumed XML/HTML output. Applications using @xmldom/xmldom before 0.8.14 or 0.9.11, or any version of the legacy xmldom package (≤0.6.0), are affected when attacker-controlled data reaches Element.setAttribute() and the result is serialized via XMLSerializer.serializeToString(). No public exploit is identified at time of analysis, but the vulnerability class is well-understood and the injection mechanism is straightforward for any attacker who can influence attribute name input.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) vulnerability could allow attackers to modify object prototypes to inject properties affecting application logic.
xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
ReDoS in @xmldom/xmldom versions 0.7.0 through 0.8.14 allows remote unauthenticated attackers to stall the Node.js event loop by submitting a small crafted XML document containing a malformed end tag. The SAX parser in lib/sax.js uses an unanchored global regex /[ \t\n\r]+$/g to trim end-tag names; a tag with N whitespace characters followed by one non-whitespace character causes the engine to retry the match from every character position with O(N) backtracking per position, yielding O(N²) total work that blocks the single-threaded event loop. No public exploit code or CISA KEV listing is identified at time of analysis, but the CVSS 4.0 score of 8.7 with VA:H and PR:N reflects the severity of unauthenticated, network-reachable availability impact.
XML injection in @xmldom/xmldom versions 0.9.10 and 0.9.11 bypasses the requireWellFormed serializer's DocumentType validation due to a multiline-flag inheritance bug in the PubidLiteral and SystemLiteral regex matchers: a publicId or systemId whose first line is a valid literal passes the check while ECMAScript line terminators (U+000A, U+000D, U+2028, U+2029) and breakout markup on subsequent lines are emitted verbatim into the <!DOCTYPE ...> declaration. This is a bypass of the mitigation introduced for the earlier DocumentType injection advisory; applications that treat requireWellFormed: true as a serialization-time security boundary against DOCTYPE injection are directly exposed. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 0.9.12.
XML injection in @xmldom/xmldom 0.9.11 allows attackers who supply crafted element or attribute names containing ECMAScript line terminators (U+000A, U+000D, U+2028, U+2029) to bypass the requireWellFormed: true serialization guard and emit arbitrary markup verbatim into serialized XML output. The bypass exploits the multiline flag inherited by the QName_exact regex in lib/grammar.js, which causes the anchors to match at line boundaries rather than string boundaries - directly circumventing the strict-name validation introduced to close earlier injection advisories. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Processing-instruction target injection in the @xmldom/xmldom JavaScript library allows XML structure breakout through unvalidated characters in Document.createProcessingInstruction() targets. Versions prior to 0.8.15 and 0.9.12 - and all versions of the legacy xmldom package (0.6.0 and earlier, which has no fix) - emit malformed processing instructions when a target contains >, ?, whitespace, or other XML-Name-invalid characters, enabling injection of arbitrary XML structure into the serialized output. No public exploit has been identified at time of analysis, and the CVE is not listed in the CISA KEV catalog.
Quadratic namespace-map allocation in xmldom's SAX parser allows unauthenticated remote attackers to exhaust the Node.js process heap by sending a compact, crafted XML document with repeated namespace prefix declarations. The unmaintained legacy `xmldom` package (versions 0.1.5-0.6.0) has no available fix, while `@xmldom/xmldom` is patched in releases 0.8.15 and 0.9.12. No public exploit has been identified at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates the attack is trivially automatable against any application that parses untrusted XML with this library.
Two independent quadratic-complexity denial-of-service paths in the xmldom JavaScript XML parser allow remote unauthenticated callers to exhaust CPU and memory by submitting crafted XML. The `@xmldom/xmldom` package before versions 0.8.15 and 0.9.12, and all versions of the legacy `xmldom` package (0.3.0-0.6.0), expose both paths through the default `DOMParser.parseFromString()` interface, requiring no authentication or special configuration. No public exploit has been identified at time of analysis, but the security advisories and fix commits are publicly available on GitHub.
Quadratic attribute-processing complexity in xmldom's DOMParser enables remote unauthenticated denial of service against any Node.js application that parses externally supplied XML. When a well-formed XML element contains many distinct attributes, DOMHandler.startElement repeatedly calls NamedNodeMap.setNamedItem, which in turn performs a full linear scan of previously inserted attributes on each insertion - producing O(N²) comparisons for N attributes and stalling the Node.js event loop before any application-level validation can execute. @xmldom/xmldom 0.8.15 and 0.9.12 contain the fix; the legacy xmldom package (≤0.6.0) has no patch and will not receive one. No public exploit has been identified at time of analysis, though the attack is trivially constructable from the published advisory alone.
Quadratic CPU and memory exhaustion in @xmldom/xmldom 0.9.0-beta.1 through 0.9.11 allows denial-of-service via small crafted HTML documents passed to DOMParser.parseFromString(). The parseHtmlSpecialContent function uses a case-sensitive indexOf() to locate closing tags for raw-text elements; when a mixed-case tag like </ScRiPt> is not found, indexOf() returns -1, and the subsequent substring(-1) call destabilizes parser progression and triggers O(N²) output amplification. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, but the attack is unauthenticated and requires no access complexity beyond supplying crafted HTML to the parser.
Silent acceptance of malformed XML end tags in xmldom's DOMParser allows crafted input to bypass parse-before-trust well-formedness gates in security-sensitive Node.js applications. The flaw affects @xmldom/xmldom prior to 0.8.15 and 0.9.12, as well as all versions of the legacy xmldom package (0.6.0 and earlier), for which no patch exists. No public exploit has been identified at time of analysis, but the parser differential is exploitable in any pipeline - SAML processors, XML signature verifiers, API validators - that treats a clean xmldom parse as a validity certificate.
XML injection via EntityReference in xmldom enables attacker-controlled XML markup to escape entity-reference boundaries when the serialized output is reparsed downstream. Applications using @xmldom/xmldom prior to 0.8.15 or 0.9.12, or any version of the legacy xmldom package (which has no fix), are affected if they explicitly call Document.createEntityReference() with attacker-supplied input and serialize the result via XMLSerializer.serializeToString(). No active exploitation is confirmed and no public exploit has been identified; the attack requires an uncommon and explicit application code pattern that the xmldom parser itself never exercises internally.
XML injection in @xmldom/xmldom 0.9.0-0.9.11 allows an attacker to embed malicious markup into serialized XML output by supplying element or attribute names containing ECMAScript line terminators (U+000A, U+000D, U+2028, U+2029). The QName_exact regex in lib/grammar.js is compiled with JavaScript's multiline flag, causing the ^ and $ anchors to match per-line rather than over the full string - a name whose first line is a valid QName passes validation while subsequent lines carry injected markup, bypassing both the default serialization path and requireWellFormed: true. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with no prerequisites reflects the high-integrity impact when an application passes attacker-controlled input to createElementNS, createAttributeNS, createDocumentType, or createAttribute.
XML injection in the xmldom serializer allows a crafted DocumentType.name containing '>' or whitespace to prematurely close the <!DOCTYPE ...> declaration and inject arbitrary sibling markup into serialized XML output. The gap exists because XMLSerializer.serializeToString() under requireWellFormed: true validates publicId, systemId, and internalSubset but emits DocumentType.name verbatim, violating the XML Name production consistently enforced for the other fields. Affected packages are @xmldom/xmldom prior to 0.8.15 and 0.9.12, and all versions of the legacy unscoped xmldom (0.6.0 and earlier) for which no vendor-released fix will be issued; no public exploit code or CISA KEV listing has been identified at time of analysis.
XML injection and cross-site scripting in the xmldom JavaScript library allows attacker-controlled tag names to be injected verbatim into serialized XML or HTML output. Applications using @xmldom/xmldom prior to 0.8.14 or 0.9.11, or the legacy xmldom package at any version, are affected when they pass externally-supplied strings to Document.createElement() and then serialize the resulting DOM with XMLSerializer.serializeToString(). The serializer's requireWellFormed: true path failed to validate element qualified names and synthesized xmlns:PREFIX declarations against the XML QName production, meaning malformed names containing characters such as '>' or '<' pass through unchecked and cause XSS when the output is rendered in a browser. No public exploit has been identified at time of analysis, though the GitHub security advisory and PR diffs include explicit test cases demonstrating injection payloads.
Quadratic regex backtracking in @xmldom/xmldom versions 0.9.0-beta.9 through 0.9.10 allows unauthenticated remote attackers to stall the Node.js event loop by supplying a small malformed XML document containing an unterminated processing instruction with a long whitespace tail. The flaw resides in the processing-instruction production regex in lib/grammar.js, where the greedy S+ separator and lazy Char*? data group endlessly repartition whitespace when the required closing ?> is absent, causing O(n²) backtracking in both parsePI and parseProcessingInstruction. No public exploit has been identified at time of analysis, but the fix commit and GitHub Security Advisory GHSA-g53g-w8rj-fmg7 fully document the vulnerable code path, making independent reproduction straightforward. Vendor-released patch: 0.9.11.
XML injection in the xmldom JavaScript library allows crafted attribute names to break out of attribute context during serialization, enabling injection of arbitrary attributes — including event handlers — into browser-consumed XML/HTML output. Applications using @xmldom/xmldom before 0.8.14 or 0.9.11, or any version of the legacy xmldom package (≤0.6.0), are affected when attacker-controlled data reaches Element.setAttribute() and the result is serialized via XMLSerializer.serializeToString(). No public exploit is identified at time of analysis, but the vulnerability class is well-understood and the injection mechanism is straightforward for any attacker who can influence attribute name input.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) vulnerability could allow attackers to modify object prototypes to inject properties affecting application logic.
xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.