xmldom vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-83616High@xmldom/xmldom: xmldom: Processing Instruction Target Injection Bypasses requireWellFormed CVE-2026-83608High@xmldom/xmldom: xmldom: DocType `name` Injection Bypasses requireWellFormed CVE-2026-83611Medium@xmldom/xmldom: xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content CVE-2026-83613High@xmldom/xmldom: xmldom: Quadratic-time attribute deduplication CVE-2026-83615High@xmldom/xmldom: xmldom: Quadratic-memory consumption CVE-2026-83614High@xmldom/xmldom: xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge CVE-2026-83607High@xmldom/xmldom: xmldom: Element name injection via createElement() bypasses requireWellFormed CVE-2026-83605High@xmldom/xmldom: xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed CVE-2026-83610Medium@xmldom/xmldom: xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization CVE-2026-41673High@xmldom/xmldom: xmldom: Uncontrolled recursion in XML serialization leads to DoS CVE-2026-41674High@xmldom/xmldom: xmldom has XML injection through unvalidated DocumentType serialization CVE-2026-41675High@xmldom/xmldom: xmldom has XML node injection through unvalidated processing instruction serialization CVE-2026-41672High@xmldom/xmldom: xmldom has XML node injection through unvalidated comment serialization CVE-2026-34601Highxmldom: xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion CVE-2022-39353Criticalxmldom: xmldom allows multiple root nodes in a DOM CVE-2021-32796Mediumxmldom: Misinterpretation of malicious XML input CVE-2021-21366Mediumxmldom: Misinterpretation of malicious XML input

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo