GHSA-h6q6-9hqw-rwfv CVE-2021-21366
Misinterpretation of malicious XML input
- Severity
- 4.3 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 1.34%
- Chance of exploitation in the next 30 days. Higher than 71.31% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Fix
0.5.0- Upgrade xmldom to this version or later
Description
Impact
xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents.
This may lead to unexpected syntactic changes during XML processing in some downstream applications.
Patches
Update to 0.5.0 (once it is released)
Workarounds
Downstream applications can validate the input and reject the maliciously crafted documents.
References
Similar to this one reported on the Go standard library:
For more information
If you have any questions or comments about this advisory:
- Open an issue in
xmldom/xmldom - Email us: send an email to all addresses that are shown by
npm owner ls xmldom
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| xmldom | < 0.5.0 |
0.5.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
xmldom npm → 0.5.0
- npm
npm install xmldom@0.5.0- yarn
yarn add xmldom@0.5.0- pnpm
pnpm add xmldom@0.5.0
Severity breakdown
CVSS 3.1 4.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Weakness
CWE-115: Misinterpretation of Input
The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.
CWE-436: Interpretation Conflict
Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-c7q8-3ch8-vqpv xmldom: Processing Instruction Target Injection Bypasses requireWellFormed | High | Also affects xmldom |
| GHSA-965w-775f-mr7g xmldom: Quadratic-memory consumption | High | Also affects xmldom |
| GHSA-93r5-fhx6-vmg9 xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge | High | Also affects xmldom |
| GHSA-8344-3jmq-59r6 xmldom: Quadratic-time attribute deduplication | High | Also affects xmldom |
| GHSA-6h8r-xr42-gp59 xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content | Medium | Also affects xmldom |
| GHSA-6gmq-8vp8-gcm6 xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization | Medium | Also affects xmldom |
| GHSA-27p8-2357-5qqv xmldom: DocType `name` Injection Bypasses requireWellFormed | High | Also affects xmldom |
| GHSA-w2rr-34g9-rvrj xmldom: Element name injection via createElement() bypasses requireWellFormed | High | Also affects xmldom |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor