CVE-2021-32796
Misinterpretation of malicious XML input in xmldom
xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This issue has been resolved in version 0.7.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Misinterpretation of malicious XML input in xmldom
xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This issue has been resolved in version 0.7.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
- Record
CVE-2021-32796- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-116
- Updated
- 2026-11-02
EUVDEUVD-2021-1574
xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This issue has been resolved in version 0.7.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
- Record
EUVD-2021-1574- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5fg8-2547-mr8q
Misinterpretation of malicious XML input
Impact
xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes during XML processing in some downstream applications.
Patches
Update to one of the fixed versions of @xmldom/xmldom (>=0.7.0)
See issue #271 for the status of publishing xmldom to npm or join #270 for Q&A/discussion until it's resolved.
Workarounds
Downstream applications can validate the input and reject the maliciously crafted documents.
References
Similar to this one reported on the Go standard library:
- https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/
- https://mattermost.com/blog/securing-xml-implementations-across-the-web/
For more information
If you have any questions or comments about this advisory:
- Open an issue in
xmldom/xmldom - Email us: send an email to all addresses that are shown by
npm owner ls @xmldom/xmldom
- Record
GHSA-5fg8-2547-mr8q- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-116
- Updated
- 2026-11-02
NVD
xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This issue has been resolved in version 0.7.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
- Record
CVE-2021-32796- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-116, CWE-91
- Updated
- 2026-11-02
OSV
xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This issue has been resolved in version 0.7.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
- Record
CVE-2021-32796- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-32796
xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This issue has been resolved in version 0.7.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
- Record
DEBIAN-CVE-2021-32796- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-5fg8-2547-mr8q
Misinterpretation of malicious XML input
Impact
xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes during XML processing in some downstream applications.
Patches
Update to one of the fixed versions of @xmldom/xmldom (>=0.7.0)
See issue #271 for the status of publishing xmldom to npm or join #270 for Q&A/discussion until it's resolved.
Workarounds
Downstream applications can validate the input and reject the maliciously crafted documents.
References
Similar to this one reported on the Go standard library:
- https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/
- https://mattermost.com/blog/securing-xml-implementations-across-the-web/
For more information
If you have any questions or comments about this advisory:
- Open an issue in
xmldom/xmldom - Email us: send an email to all addresses that are shown by
npm owner ls @xmldom/xmldom
- Record
GHSA-5fg8-2547-mr8q- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-116
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-32796
xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This issue has been resolved in version 0.7.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
- Record
UBUNTU-CVE-2021-32796- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1772583195 No score
TuxCare security update for xmldom (2 CVEs)
TuxCare rebuilt xmldom to address 2 CVEs. Fixed in 0.1.31-tuxcare.1.
- Record
CLSA-2026-1772583195- Updated
- 2026-11-05
OSVCLSA-2026-1778114662 No score
TuxCare security update for xmldom (3 CVEs)
TuxCare rebuilt xmldom to address 3 CVEs. Fixed in 0.6.0-tuxcare.2.
- Record
CLSA-2026-1778114662- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xmldomnpm |
through 0.6.0 | None known |
@xmldom/xmldomnpm |
before 0.7.0 | 0.7.0 |
xmldomTuxCare:npm From an advisory covering 2 CVEs |
0.1.31-tuxcare.0 up to 0.1.31-tuxcare.1, plus listed versions 0.1.31 |
0.1.31-tuxcare.1 |
xmldomTuxCare:npm From an advisory covering 3 CVEs |
0.6.0-tuxcare.0 up to 0.6.0-tuxcare.2, plus listed versions 0.6.00.6.0-tuxcare.1 |
0.6.0-tuxcare.2 |
node-xmldomDebian:12 |
before 0.7.3-1 | 0.7.3-1 |
node-xmldomDebian:13 |
before 0.7.3-1 | 0.7.3-1 |
node-xmldomDebian:14 |
before 0.7.3-1 | 0.7.3-1 |
node-xmldomUbuntu:20.04:LTS |
All versions, plus listed versions 0.1.27+ds-10.1.27+ds-1+deb10u2build0.20.04.1 |
None known |
node-xmldomUbuntu:24.04:LTS |
All versions, plus listed versions 0.8.6-1 |
None known |
node-xmldomUbuntu:25.10 |
All versions, plus listed versions 0.9.6-1 |
None known |
node-xmldomUbuntu:26.10 |
All versions, plus listed versions 0.9.8-20.9.10-20.9.11-1 |
None known |
node-xmldomUbuntu:26.04:LTS |
All versions, plus listed versions 0.9.6-10.9.8-10.9.8-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-32796 is a medium vulnerability (CVSS 6.5) in Xmldom, published July 27, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.36%, the 71st percentile. Fixed in @xmldom/xmldom 0.7.0.
References
mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities
github.com/xmldom/xmldom/security/advisories/GHSA-5fg8-2547-mr8q
nvd.nist.gov/vuln/detail/CVE-2021-32796
npmjs.com/package/@xmldom/xmldom