@xmldom/xmldom (npm)
Advisories
41
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 0.9.12 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install @xmldom/xmldom@0.9.12yarn
yarn add @xmldom/xmldom@0.9.12pnpm
pnpm add @xmldom/xmldom@0.9.12Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-x4fp-j954-r2f4 xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser |
High EPSS 0.52% |
>= 0.7.0, < 0.8.15 | 0.8.15 |
| GHSA-vr34-hp96-76pp xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator |
High EPSS 0.57% |
>= 0.9.10, < 0.9.12 | 0.9.12 |
| GHSA-jxjr-3g7g-3944 xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator |
High EPSS 0.57% |
>= 0.9.11, < 0.9.12 | 0.9.12 |
| GHSA-c7q8-3ch8-vqpv xmldom: Processing Instruction Target Injection Bypasses requireWellFormed |
High EPSS 0.61% |
>= 0.9.0, < 0.9.12 | 0.9.12 |
| GHSA-c7q8-3ch8-vqpv xmldom: Processing Instruction Target Injection Bypasses requireWellFormed |
High EPSS 0.61% |
>= 0.7.0, < 0.8.15 | 0.8.15 |
| GHSA-965w-775f-mr7g xmldom: Quadratic-memory consumption |
High EPSS 0.59% |
>= 0.7.0, < 0.8.15 | 0.8.15 |
| GHSA-965w-775f-mr7g xmldom: Quadratic-memory consumption |
High EPSS 0.59% |
>= 0.9.0, < 0.9.12 | 0.9.12 |
| GHSA-93r5-fhx6-vmg9 xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge |
High EPSS 0.59% |
>= 0.7.0, < 0.8.15 | 0.8.15 |
| GHSA-93r5-fhx6-vmg9 xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge |
High EPSS 0.59% |
>= 0.9.0, < 0.9.12 | 0.9.12 |
| GHSA-8344-3jmq-59r6 xmldom: Quadratic-time attribute deduplication |
High EPSS 0.60% |
>= 0.9.0, < 0.9.12 | 0.9.12 |
| GHSA-8344-3jmq-59r6 xmldom: Quadratic-time attribute deduplication |
High EPSS 0.60% |
>= 0.7.0, < 0.8.15 | 0.8.15 |
| GHSA-6mj3-qw4j-hgrw xmldom: HTML raw-text closing-tag case mismatch causes output amplification |
High EPSS 0.52% |
>= 0.9.0-beta.1, < 0.9.12 | 0.9.12 |
| GHSA-6h8r-xr42-gp59 xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content |
Medium EPSS 0.62% |
>= 0.7.0, < 0.8.15 | 0.8.15 |
| GHSA-6h8r-xr42-gp59 xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content |
Medium EPSS 0.62% |
>= 0.9.0, < 0.9.12 | 0.9.12 |
| GHSA-6gmq-8vp8-gcm6 xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization |
Medium EPSS 0.59% |
>= 0.7.0, < 0.8.15 | 0.8.15 |
| GHSA-6gmq-8vp8-gcm6 xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization |
Medium EPSS 0.59% |
>= 0.9.0, < 0.9.12 | 0.9.12 |
| GHSA-3px3-54cx-rmw9 xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path |
High EPSS 0.54% |
>= 0.9.0, < 0.9.12 | 0.9.12 |
| GHSA-27p8-2357-5qqv xmldom: DocType `name` Injection Bypasses requireWellFormed |
High EPSS 0.61% |
>= 0.9.0, < 0.9.12 | 0.9.12 |
| GHSA-27p8-2357-5qqv xmldom: DocType `name` Injection Bypasses requireWellFormed |
High EPSS 0.61% |
>= 0.7.0, < 0.8.15 | 0.8.15 |
| GHSA-w2rr-34g9-rvrj xmldom: Element name injection via createElement() bypasses requireWellFormed |
High EPSS 0.61% |
>= 0.9.0, < 0.9.11 | 0.9.11 |
| GHSA-w2rr-34g9-rvrj xmldom: Element name injection via createElement() bypasses requireWellFormed |
High EPSS 0.61% |
>= 0.7.0, < 0.8.14 | 0.8.14 |
| GHSA-g53g-w8rj-fmg7 xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions |
High EPSS 0.52% |
>= 0.9.0-beta.9, < 0.9.11 | 0.9.11 |
| GHSA-4w3w-2rp5-g8jm xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed |
High EPSS 0.61% |
>= 0.9.0, < 0.9.11 | 0.9.11 |
| GHSA-4w3w-2rp5-g8jm xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed |
High EPSS 0.61% |
>= 0.7.0, < 0.8.14 | 0.8.14 |
| GHSA-2v35-w6hq-6mfw xmldom: Uncontrolled recursion in XML serialization leads to DoS |
High EPSS 0.64% |
< 0.8.13 | 0.8.13 |
| GHSA-2v35-w6hq-6mfw xmldom: Uncontrolled recursion in XML serialization leads to DoS |
High EPSS 0.64% |
>= 0.9.0, < 0.9.10 | 0.9.10 |
| GHSA-f6ww-3ggp-fr8h xmldom has XML injection through unvalidated DocumentType serialization |
High EPSS 0.56% |
>= 0.9.0, < 0.9.10 | 0.9.10 |
| GHSA-f6ww-3ggp-fr8h xmldom has XML injection through unvalidated DocumentType serialization |
High EPSS 0.56% |
< 0.8.13 | 0.8.13 |
| GHSA-x6wf-f3px-wcqx xmldom has XML node injection through unvalidated processing instruction serialization |
High EPSS 0.47% |
>= 0.9.0, < 0.9.10 | 0.9.10 |
| GHSA-x6wf-f3px-wcqx xmldom has XML node injection through unvalidated processing instruction serialization |
High EPSS 0.47% |
< 0.8.13 | 0.8.13 |
| GHSA-j759-j44w-7fr8 xmldom has XML node injection through unvalidated comment serialization |
High EPSS 0.46% |
>= 0.9.0, < 0.9.10 | 0.9.10 |
| GHSA-j759-j44w-7fr8 xmldom has XML node injection through unvalidated comment serialization |
High EPSS 0.46% |
< 0.8.13 | 0.8.13 |
| GHSA-wh4c-j3r5-mjhp xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion |
High EPSS 0.49% |
< 0.8.12 | 0.8.12 |
| GHSA-wh4c-j3r5-mjhp xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion |
High EPSS 0.49% |
>= 0.9.0, < 0.9.9 | 0.9.9 |
| GHSA-crh6-fp67-6883 xmldom allows multiple root nodes in a DOM |
Critical EPSS 1.60% |
>= 0.9.0-beta.1, < 0.9.0-beta.4 | 0.9.0-beta.4 |
| GHSA-crh6-fp67-6883 xmldom allows multiple root nodes in a DOM |
Critical EPSS 1.60% |
< 0.7.7 | 0.7.7 |
| GHSA-crh6-fp67-6883 xmldom allows multiple root nodes in a DOM |
Critical EPSS 1.60% |
>= 0.8.0, < 0.8.4 | 0.8.4 |
| GHSA-9pgh-qqpf-7wqj Withdrawn: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in @xmldom/xmldom and xmldom Withdrawn |
Critical EPSS 2.13% |
< 0.7.6 | 0.7.6 |
| GHSA-9pgh-qqpf-7wqj Withdrawn: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in @xmldom/xmldom and xmldom Withdrawn |
Critical EPSS 2.13% |
>= 0.8.0, < 0.8.3 | 0.8.3 |
| GHSA-9pgh-qqpf-7wqj Withdrawn: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in @xmldom/xmldom and xmldom Withdrawn |
Critical EPSS 2.13% |
>= 0.9.0-beta.1, < 0.9.0-beta.2 | 0.9.0-beta.2 |
| GHSA-5fg8-2547-mr8q Misinterpretation of malicious XML input |
Medium EPSS 1.36% |
< 0.7.0 | 0.7.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor