What’s Vulnerable › Products
xmldom vulnerabilities
24 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 20 published in the last 12 months.
Check whether your xmldom version is affected
Latest xmldom vulnerabilities
- CVE-2026-83619 — xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser (CVSS 8.7)
- CVE-2026-83618 — xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator (CVSS 8.7)
- CVE-2026-83617 — xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator (CVSS 8.7)
- CVE-2026-83616 — xmldom: Processing Instruction Target Injection Bypasses requireWellFormed (CVSS 8.7)
- CVE-2026-83615 — xmldom: Quadratic-memory consumption (CVSS 8.7)
- CVE-2026-83614 — xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge (CVSS 8.7)
- CVE-2026-83613 — xmldom: Quadratic-time attribute deduplication (CVSS 8.7)
- CVE-2026-83612 — xmldom: HTML raw-text closing-tag case mismatch causes output amplification (CVSS 8.7)
- CVE-2026-83611 — xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content (CVSS 6.9)
- CVE-2026-83610 — xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization (CVSS 6.3)
- CVE-2026-83609 — xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path (CVSS 8.7)
- CVE-2026-83608 — xmldom: DocType `name` Injection Bypasses requireWellFormed (CVSS 8.7)
- CVE-2026-83607 — xmldom: Element name injection via createElement() bypasses requireWellFormed (CVSS 8.7)
- CVE-2026-83606 — xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions (CVSS 8.7)
- CVE-2026-83605 — xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed (CVSS 8.7)
- CVE-2026-41675 — xmldom: XML node injection through unvalidated processing instruction serialization (CVSS 7.5)
- CVE-2026-41674 — xmldom: XML injection through unvalidated DocumentType serialization (CVSS 7.5)
- CVE-2026-41673 — xmldom: Denial of service via uncontrolled recursion in XML serialization (CVSS 7.5)
- CVE-2026-41672 — xmldom: XML node injection through unvalidated comment serialization (CVSS 7.5)
- CVE-2026-34601 — xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion (CVSS 7.5)
- CVE-2022-39353 — xmldom allows multiple root nodes in a DOM (CVSS 9.8)
- CVE-2022-37616 — (CVSS 9.8)
- CVE-2021-32796 — Misinterpretation of malicious XML input in xmldom (CVSS 5.3)
- CVE-2021-21366 — Misinterpretation of malicious XML input (CVSS 4.3)