Skip to content
Threat Feed
Subscribe

Vendor

Xmldom

3 briefs RSS
high advisory

xmldom requireWellFormed Serialization Bypass

The xmldom serializer fails to properly validate element and attribute names when the requireWellFormed option is enabled, allowing attackers to inject arbitrary markup via line-terminated strings.

xmldom +3 injection xss library-vulnerability
2t 1c
high advisory

XML Injection Vulnerability in @xmldom/xmldom via Processing Instruction Targets

The @xmldom/xmldom library fails to validate the target parameter in createProcessingInstruction, enabling attackers to break out of XML processing instructions and inject arbitrary content when serializing with the requireWellFormed flag.

@xmldom/xmldom +2 injection xss xxe vulnerability
1t 1c
high advisory

xmldom XML Node Injection via Comment Serialization

The xmldom library is vulnerable to XML node injection, allowing attackers to inject arbitrary XML nodes into serialized output by manipulating comment content; this is mitigated by using the `requireWellFormed` option in `serializeToString` after upgrading to version 0.8.13 or 0.9.10.

xmldom xml injection deserialization vulnerability
2r 1t