Description
xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This issue has been resolved in version 0.7.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
References (3)
Scores
CVSS v3
6.5
EPSS
0.0115
EPSS Percentile
78.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Details
CWE
CWE-91
CWE-116
Status
published
Products (3)
npm/xmldom
0npm
xmldom/xmldom
0 - 0.7.0npm
xmldom_project/xmldom
< 0.7.0
Published
Jul 27, 2021
Tracked Since
Feb 18, 2026