CVE-2021-21366
Misinterpretation of malicious XML input
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This is fixed in version 0.5.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Misinterpretation of malicious XML input
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This is fixed in version 0.5.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
- Record
CVE-2021-21366- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-436, CWE-115
- Updated
- 2026-11-02
EUVDEUVD-2021-0663
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This is fixed in version 0.5.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
- Record
EUVD-2021-0663- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h6q6-9hqw-rwfv
Misinterpretation of malicious XML input
Impact
xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents.
This may lead to unexpected syntactic changes during XML processing in some downstream applications.
Patches
Update to 0.5.0 (once it is released)
Workarounds
Downstream applications can validate the input and reject the maliciously crafted documents.
References
Similar to this one reported on the Go standard library:
For more information
If you have any questions or comments about this advisory:
- Open an issue in
xmldom/xmldom - Email us: send an email to all addresses that are shown by
npm owner ls xmldom
- Record
GHSA-h6q6-9hqw-rwfv- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-115, CWE-436
- Updated
- 2026-11-02
NVD
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This is fixed in version 0.5.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
- Record
CVE-2021-21366- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-115, CWE-436
- Updated
- 2026-11-02
OSV
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This is fixed in version 0.5.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
- Record
CVE-2021-21366- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-21366
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This is fixed in version 0.5.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
- Record
DEBIAN-CVE-2021-21366- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-h6q6-9hqw-rwfv
Misinterpretation of malicious XML input
Impact
xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents.
This may lead to unexpected syntactic changes during XML processing in some downstream applications.
Patches
Update to 0.5.0 (once it is released)
Workarounds
Downstream applications can validate the input and reject the maliciously crafted documents.
References
Similar to this one reported on the Go standard library:
For more information
If you have any questions or comments about this advisory:
- Open an issue in
xmldom/xmldom - Email us: send an email to all addresses that are shown by
npm owner ls xmldom
- Record
GHSA-h6q6-9hqw-rwfv- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-115, CWE-436
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-21366
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This is fixed in version 0.5.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
- Record
UBUNTU-CVE-2021-21366- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1772583195 No score
TuxCare security update for xmldom (2 CVEs)
TuxCare rebuilt xmldom to address 2 CVEs. Fixed in 0.1.31-tuxcare.1.
- Record
CLSA-2026-1772583195- Updated
- 2026-11-05
OSVUSN-6102-1 No score
node-xmldom vulnerabilities
It was discovered that xmldom incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause unexpected syntactic changes during XML processing. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-21366)
It was discovered that xmldom incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. (CVE-2022-37616, CVE-2022-39353)
- Record
USN-6102-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xmldomnpm |
before 0.5.0 | 0.5.0 |
xmldomTuxCare:npm From an advisory covering 2 CVEs |
0.1.31-tuxcare.0 up to 0.1.31-tuxcare.1, plus listed versions 0.1.31 |
0.1.31-tuxcare.1 |
node-xmldomDebian:12 |
before 0.5.0-1 | 0.5.0-1 |
node-xmldomDebian:13 |
before 0.5.0-1 | 0.5.0-1 |
node-xmldomDebian:14 |
before 0.5.0-1 | 0.5.0-1 |
node-xmldomDebian:10 From an advisory covering 2 CVEs |
before 0.1.27+ds-1+deb10u2, plus listed versions 0.1.27+ds-10.1.27+ds-1+deb10u1 |
0.1.27+ds-1+deb10u2 |
node-xmldomUbuntu:20.04:LTS |
before 0.1.27+ds-1+deb10u2build0.20.04.1, plus listed versions 0.1.27+ds-1 |
0.1.27+ds-1+deb10u2build0.20.04.1 |
node-xmldomUbuntu:20.04:LTS From an advisory covering 3 CVEs |
before 0.1.27+ds-1+deb10u2build0.20.04.1, plus listed versions 0.1.27+ds-1 |
0.1.27+ds-1+deb10u2build0.20.04.1 |
node-xmldomUbuntu:22.04:LTS From an advisory covering 3 CVEs |
before 0.7.5-1ubuntu0.22.04.1, plus listed versions 0.5.0-10.7.3-10.7.5-1 |
0.7.5-1ubuntu0.22.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-21366 is a medium vulnerability (CVSS 4.3) in Xmldom, published March 12, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.34%, the 71st percentile. Fixed in xmldom 0.5.0.
References
github.com/xmldom/xmldom/security/advisories/GHSA-h6q6-9hqw-rwfv
npmjs.com/package/xmldom
lists.debian.org/debian-lts-announce/2023/01/msg00000.html
nvd.nist.gov/vuln/detail/CVE-2021-21366