Skip to content
Threat Feed

Product

Xmldom

3 briefs RSS
medium advisory

xmldom Uncontrolled Recursion DoS Vulnerability

The xmldom library is vulnerable to a denial-of-service (DoS) attack due to uncontrolled recursion in XML serialization leading to application crashes.

xmldom dos recursion javascript
2r 1t
high advisory

xmldom XML Node Injection via Comment Serialization

The xmldom library is vulnerable to XML node injection, allowing attackers to inject arbitrary XML nodes into serialized output by manipulating comment content; this is mitigated by using the `requireWellFormed` option in `serializeToString` after upgrading to version 0.8.13 or 0.9.10.

xmldom xml injection deserialization vulnerability
2r 1t
high advisory

xmldom XML Injection Vulnerability

The xmldom package is vulnerable to XML injection. The package serializes DocumentType node fields (internalSubset, publicId, systemId) verbatim without any escaping or validation. When these fields are set programmatically to attacker-controlled strings, XMLSerializer.serializeToString can produce output where the DOCTYPE declaration is terminated early and arbitrary markup appears outside it. To address this applications that pass untrusted data to createDocumentType() or write untrusted values directly to a DocumentType node's publicId, systemId, or internalSubset properties should audit all serializeToString() call sites and add the option.

@xmldom/xmldom +1 xml-injection xxe dom xmldom
2r 1t