npm

@xmldom/xmldom

23 Total advisories

23 Vulnerabilities

0 Malware

Dependency scanning

Check whether @xmldom/xmldom is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

@xmldom/xmldom

Vulnerabilities

xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization

xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion

xmldom has XML node injection through unvalidated comment serialization

xmldom has XML node injection through unvalidated processing instruction serialization

xmldom has XML injection through unvalidated DocumentType serialization

xmldom: Uncontrolled recursion in XML serialization leads to DoS

xmldom allows multiple root nodes in a DOM

Misinterpretation of malicious XML input

xmldom: Quadratic-time attribute deduplication

xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser

xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator

xmldom: Processing Instruction Target Injection Bypasses requireWellFormed

xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator

xmldom: Quadratic-memory consumption

xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge

xmldom: HTML raw-text closing-tag case mismatch causes output amplification

xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content

xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path

xmldom: DocType `name` Injection Bypasses requireWellFormed

xmldom: Element name injection via createElement() bypasses requireWellFormed

xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions

Withdrawn: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in @xmldom/xmldom and xmldom

Browse more npm advisories

Start Securing