xmldom (npm)
Advisories
18
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 0.5.0 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install xmldom@0.5.0yarn
yarn add xmldom@0.5.0pnpm
pnpm add xmldom@0.5.0Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-c7q8-3ch8-vqpv xmldom: Processing Instruction Target Injection Bypasses requireWellFormed |
High EPSS 0.61% |
<= 0.6.0 | No fix yet |
| GHSA-965w-775f-mr7g xmldom: Quadratic-memory consumption |
High EPSS 0.59% |
>= 0.1.5, <= 0.6.0 | No fix yet |
| GHSA-93r5-fhx6-vmg9 xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge |
High EPSS 0.59% |
>= 0.3.0, <= 0.6.0 | No fix yet |
| GHSA-8344-3jmq-59r6 xmldom: Quadratic-time attribute deduplication |
High EPSS 0.60% |
<= 0.6.0 | No fix yet |
| GHSA-6h8r-xr42-gp59 xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content |
Medium EPSS 0.62% |
<= 0.6.0 | No fix yet |
| GHSA-6gmq-8vp8-gcm6 xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization |
Medium EPSS 0.59% |
<= 0.6.0 | No fix yet |
| GHSA-27p8-2357-5qqv xmldom: DocType `name` Injection Bypasses requireWellFormed |
High EPSS 0.61% |
<= 0.6.0 | No fix yet |
| GHSA-w2rr-34g9-rvrj xmldom: Element name injection via createElement() bypasses requireWellFormed |
High EPSS 0.61% |
<= 0.6.0 | No fix yet |
| GHSA-4w3w-2rp5-g8jm xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed |
High EPSS 0.61% |
<= 0.6.0 | No fix yet |
| GHSA-2v35-w6hq-6mfw xmldom: Uncontrolled recursion in XML serialization leads to DoS |
High EPSS 0.64% |
<= 0.6.0 | No fix yet |
| GHSA-f6ww-3ggp-fr8h xmldom has XML injection through unvalidated DocumentType serialization |
High EPSS 0.56% |
<= 0.6.0 | No fix yet |
| GHSA-x6wf-f3px-wcqx xmldom has XML node injection through unvalidated processing instruction serialization |
High EPSS 0.47% |
<= 0.6.0 | No fix yet |
| GHSA-j759-j44w-7fr8 xmldom has XML node injection through unvalidated comment serialization |
High EPSS 0.46% |
<= 0.6.0 | No fix yet |
| GHSA-wh4c-j3r5-mjhp xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion |
High EPSS 0.49% |
<= 0.6.0 | No fix yet |
| GHSA-crh6-fp67-6883 xmldom allows multiple root nodes in a DOM |
Critical EPSS 1.60% |
<= 0.6.0 | No fix yet |
| GHSA-9pgh-qqpf-7wqj Withdrawn: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in @xmldom/xmldom and xmldom Withdrawn |
Critical EPSS 2.13% |
<= 0.6.0 | No fix yet |
| GHSA-5fg8-2547-mr8q Misinterpretation of malicious XML input |
Medium EPSS 1.36% |
<= 0.6.0 | No fix yet |
| GHSA-h6q6-9hqw-rwfv Misinterpretation of malicious XML input |
Medium EPSS 1.34% |
< 0.5.0 | 0.5.0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor