npm

xmldom

18 Total advisories

18 Vulnerabilities

0 Malware

Dependency scanning

Check whether xmldom is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

xmldom

Vulnerabilities

xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization

xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion

xmldom has XML node injection through unvalidated comment serialization

xmldom has XML node injection through unvalidated processing instruction serialization

xmldom has XML injection through unvalidated DocumentType serialization

xmldom: Uncontrolled recursion in XML serialization leads to DoS

xmldom allows multiple root nodes in a DOM

Misinterpretation of malicious XML input

Misinterpretation of malicious XML input

xmldom: Quadratic-time attribute deduplication

xmldom: Processing Instruction Target Injection Bypasses requireWellFormed

xmldom: Quadratic-memory consumption

xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge

xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content

xmldom: DocType `name` Injection Bypasses requireWellFormed

xmldom: Element name injection via createElement() bypasses requireWellFormed

xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

Withdrawn: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in @xmldom/xmldom and xmldom

Browse more npm advisories

Start Securing