Skip to content
@xmldom Xmldom vulnerabilities
-
@xmldom xmldom
xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser
CVE-2026-83619
Fix available
8.7 High
-
@xmldom xmldom
xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator
CVE-2026-83618
Fix available
8.7 High
-
@xmldom xmldom
xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator
CVE-2026-83617
Fix available
8.7 High
-
@xmldom xmldom
xmldom: Processing Instruction Target Injection Bypasses requireWellFormed
CVE-2026-83616
Fix available
8.7 High
-
@xmldom xmldom
xmldom: Quadratic-memory consumption
CVE-2026-83615
Fix available
8.7 High
-
@xmldom xmldom
xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge
CVE-2026-83614
Fix available
8.7 High
-
@xmldom xmldom
xmldom: Quadratic-time attribute deduplication
CVE-2026-83613
Fix available
8.7 High
-
@xmldom xmldom
xmldom: HTML raw-text closing-tag case mismatch causes output amplification
CVE-2026-83612
Fix available
8.7 High
-
@xmldom xmldom
xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content
CVE-2026-83611
Fix available
6.9 Medium
-
@xmldom xmldom
xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization
CVE-2026-83610
Fix available
6.3 Medium
-
@xmldom xmldom
xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path
CVE-2026-83609
Fix available
8.7 High
-
@xmldom xmldom
xmldom: DocType `name` Injection Bypasses requireWellFormed
CVE-2026-83608
Fix available
8.7 High
-
@xmldom xmldom
xmldom: Element name injection via createElement() bypasses requireWellFormed
CVE-2026-83607
Fix available
8.7 High
-
@xmldom xmldom
xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions
CVE-2026-83606
Fix available
8.7 High
-
@xmldom xmldom
xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
CVE-2026-83605
Fix available
8.7 High