Xxmldom

Products

Exploited and recent CVEs

• CVE-2026-83619 High 8.7 xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser 0.5%
• CVE-2026-83618 High 8.7 xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator 0.6%
• CVE-2026-83617 High 8.7 xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator 0.6%
• CVE-2026-83616 High 8.7 xmldom: Processing Instruction Target Injection Bypasses requireWellFormed 0.6%
• CVE-2026-83615 High 8.7 xmldom: Quadratic-memory consumption 0.6%
• CVE-2026-83614 High 8.7 xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge 0.6%
• CVE-2026-83613 High 8.7 xmldom: Quadratic-time attribute deduplication 0.6%
• CVE-2026-83612 High 8.7 xmldom: HTML raw-text closing-tag case mismatch causes output amplification 0.5%
• CVE-2026-83611 Medium 6.9 xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content 0.6%
• CVE-2026-83610 Medium 6.3 xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization 0.6%
• CVE-2026-83609 High 8.7 xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path 0.5%
• CVE-2026-83608 High 8.7 xmldom: DocType `name` Injection Bypasses requireWellFormed 0.6%
• CVE-2026-83607 High 8.7 xmldom: Element name injection via createElement() bypasses requireWellFormed 0.6%
• CVE-2026-83606 High 8.7 xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions 0.5%
• CVE-2026-83605 High 8.7 xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed 0.6%
• CVE-2026-41675 High 7.5 xmldom: XML node injection through unvalidated processing instruction serialization 0.5%
• CVE-2026-41674 High 7.5 xmldom: XML injection through unvalidated DocumentType serialization 0.6%
• CVE-2026-41673 High 7.5 xmldom: Denial of service via uncontrolled recursion in XML serialization 0.6%
• CVE-2026-41672 High 7.5 xmldom: XML node injection through unvalidated comment serialization 0.5%
• CVE-2026-34601 High 7.5 xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion 0.5%
• CVE-2022-39353 Critical 9.4 xmldom allows multiple root nodes in a DOM 1.6%
• CVE-2021-32796 Medium 6.5 Misinterpretation of malicious XML input in xmldom 1.4%
• CVE-2021-21366 Medium 4.3 Misinterpretation of malicious XML input 1.3%