@xmldom/xmldom vulnerabilities (Root)
17 vulnerabilities.
-
@xmldom/xmldomRoot xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser 8.7 High -
@xmldom/xmldomRoot xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator 8.7 High -
@xmldom/xmldomRoot xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator 8.7 High -
@xmldom/xmldomRoot xmldom: Processing Instruction Target Injection Bypasses requireWellFormed 8.7 High -
@xmldom/xmldomRoot xmldom: Quadratic-memory consumption 8.7 High -
@xmldom/xmldomRoot xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge 8.7 High -
@xmldom/xmldomRoot xmldom: Quadratic-time attribute deduplication 8.7 High -
@xmldom/xmldomRoot xmldom: HTML raw-text closing-tag case mismatch causes output amplification 8.7 High -
@xmldom/xmldomRoot xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path 8.7 High -
@xmldom/xmldomRoot xmldom: DocType `name` Injection Bypasses requireWellFormed 8.7 High -
@xmldom/xmldomRoot xmldom: Element name injection via createElement() bypasses requireWellFormed 8.7 High -
@xmldom/xmldomRoot xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed 8.7 High -
@xmldom/xmldomRoot xmldom: Denial of service via uncontrolled recursion in XML serialization 8.7 High -
@xmldom/xmldomRoot xmldom: XML injection through unvalidated DocumentType serialization 8.7 High -
@xmldom/xmldomRoot xmldom: XML node injection through unvalidated processing instruction serialization 8.7 High -
@xmldom/xmldomRoot xmldom: XML node injection through unvalidated comment serialization 8.7 High -
@xmldom/xmldomRoot xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion 7.5 High