XM
Product
xmldom
21
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 18Medium 2Low 0
Watch
Add xmldom to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-83619 | 8.7 | Sep 1 | xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser Affected: >= 0.7.0, < 0.8.15 |
| CVE-2026-83618 | 8.7 | Sep 1 | xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator Affected: >= 0.9.10, < 0.9.12 |
| CVE-2026-83617 | 8.7 | Sep 1 | xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator Affected: >= 0.9.11, < 0.9.12 |
| CVE-2026-83616 | 8.7 | Sep 1 | xmldom: Processing Instruction Target Injection Bypasses requireWellFormed Affected: <= 0.6.0 |
| CVE-2026-83615 | 8.7 | Sep 1 | xmldom: Quadratic-memory consumption Affected: >= 0.7.0, < 0.8.15; >= 0.9.0, < 0.9.12 |
| CVE-2026-83614 | 8.7 | Sep 1 | xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge Affected: >= 0.3.0, <= 0.6.0 |
| CVE-2026-83613 | 8.7 | Sep 1 | xmldom: Quadratic-time attribute deduplication Affected: <= 0.6.0 |
| CVE-2026-83612 | 8.7 | Sep 1 | xmldom: HTML raw-text closing-tag case mismatch causes output amplification Affected: >= 0.9.0-beta.1, < 0.9.12 |
| CVE-2026-83609 | 8.7 | Sep 1 | xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path Affected: >= 0.9.0, < 0.9.12 |
| CVE-2026-83608 | 8.7 | Sep 1 | xmldom: DocType `name` Injection Bypasses requireWellFormed Affected: >= 0.9.0, < 0.9.12; >= 0.7.0, < 0.8.15 |
| CVE-2026-83607 | 8.7 | Sep 1 | xmldom: Element name injection via createElement() bypasses requireWellFormed Affected: <= 0.6.0 |
| CVE-2026-83606 | 8.7 | Sep 1 | xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions Affected: >= 0.9.0-beta.9, < 0.9.11 |
| CVE-2026-83605 | 8.7 | Sep 1 | xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed Affected: <= 0.6.0 |
| CVE-2026-41675 | 7.5 | May 7 | xmldom: XML node injection through unvalidated processing instruction serialization Affected: xmldom <= 0.6.0; @xmldom/xmldom >= 0.9.0, < 0.9.10; @xmldom/xmldom < 0.8.13 |
| CVE-2026-41674 | 7.5 | May 7 | xmldom: XML injection through unvalidated DocumentType serialization Affected: xmldom <= 0.6.0; @xmldom/xmldom >= 0.9.0, < 0.9.10; @xmldom/xmldom < 0.8.13 |
| CVE-2026-41673 | 7.5 | May 7 | xmldom: Denial of service via uncontrolled recursion in XML serialization Affected: xmldom <= 0.6.0; @xmldom/xmldom >= 0.9.0, < 0.9.10; @xmldom/xmldom < 0.8.13 |
| CVE-2026-41672 | 7.5 | May 7 | xmldom: XML node injection through unvalidated comment serialization Affected: xmldom <= 0.6.0; @xmldom/xmldom >= 0.9.0, < 0.9.10; @xmldom/xmldom < 0.8.13 |
| CVE-2026-34601 | 7.5 | Apr 2 | xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion Affected: xmldom <= 0.6.0; @xmldom/xmldom < 0.8.12; @xmldom/xmldom >= 0.9.0, < 0.9.9 |
Showing 18