XM
Product
xmldom
21
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 18Medium 2Low 0
Watch
Add xmldom to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-39353 | 9.8 | Nov 2 | xmldom allows multiple root nodes in a DOM Affected: <= 0.6.0; < 0.7.7; >= 0.8.0, < 0.8.4; >= 0.9.0-beta.1, < 0.9.0-beta.4 |
| CVE-2026-83619 | 8.7 | Sep 1 | xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser Affected: >= 0.7.0, < 0.8.15 |
| CVE-2026-83618 | 8.7 | Sep 1 | xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator Affected: >= 0.9.10, < 0.9.12 |
| CVE-2026-83617 | 8.7 | Sep 1 | xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator Affected: >= 0.9.11, < 0.9.12 |
| CVE-2026-83616 | 8.7 | Sep 1 | xmldom: Processing Instruction Target Injection Bypasses requireWellFormed Affected: <= 0.6.0 |
| CVE-2026-83615 | 8.7 | Sep 1 | xmldom: Quadratic-memory consumption Affected: >= 0.7.0, < 0.8.15; >= 0.9.0, < 0.9.12 |
| CVE-2026-83614 | 8.7 | Sep 1 | xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge Affected: >= 0.3.0, <= 0.6.0 |
| CVE-2026-83613 | 8.7 | Sep 1 | xmldom: Quadratic-time attribute deduplication Affected: <= 0.6.0 |
| CVE-2026-83612 | 8.7 | Sep 1 | xmldom: HTML raw-text closing-tag case mismatch causes output amplification Affected: >= 0.9.0-beta.1, < 0.9.12 |
| CVE-2026-83609 | 8.7 | Sep 1 | xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path Affected: >= 0.9.0, < 0.9.12 |
| CVE-2026-83608 | 8.7 | Sep 1 | xmldom: DocType `name` Injection Bypasses requireWellFormed Affected: >= 0.9.0, < 0.9.12; >= 0.7.0, < 0.8.15 |
| CVE-2026-83607 | 8.7 | Sep 1 | xmldom: Element name injection via createElement() bypasses requireWellFormed Affected: <= 0.6.0 |
| CVE-2026-83606 | 8.7 | Sep 1 | xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions Affected: >= 0.9.0-beta.9, < 0.9.11 |
| CVE-2026-83605 | 8.7 | Sep 1 | xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed Affected: <= 0.6.0 |
| CVE-2026-41675 | 7.5 | May 7 | xmldom: XML node injection through unvalidated processing instruction serialization Affected: xmldom <= 0.6.0; @xmldom/xmldom >= 0.9.0, < 0.9.10; @xmldom/xmldom < 0.8.13 |
| CVE-2026-41674 | 7.5 | May 7 | xmldom: XML injection through unvalidated DocumentType serialization Affected: xmldom <= 0.6.0; @xmldom/xmldom >= 0.9.0, < 0.9.10; @xmldom/xmldom < 0.8.13 |
| CVE-2026-41673 | 7.5 | May 7 | xmldom: Denial of service via uncontrolled recursion in XML serialization Affected: xmldom <= 0.6.0; @xmldom/xmldom >= 0.9.0, < 0.9.10; @xmldom/xmldom < 0.8.13 |
| CVE-2026-41672 | 7.5 | May 7 | xmldom: XML node injection through unvalidated comment serialization Affected: xmldom <= 0.6.0; @xmldom/xmldom >= 0.9.0, < 0.9.10; @xmldom/xmldom < 0.8.13 |
| CVE-2026-34601 | 7.5 | Apr 2 | xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion Affected: xmldom <= 0.6.0; @xmldom/xmldom < 0.8.12; @xmldom/xmldom >= 0.9.0, < 0.9.9 |
| CVE-2026-83611 | 6.9 | Sep 1 | xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content Affected: <= 0.6.0 |
| CVE-2026-83610 | 6.3 | Sep 1 | xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization Affected: >= 0.7.0, < 0.8.15; >= 0.9.0, < 0.9.12 |
Showing 21