Lucene search
AnonymousNODEJS:1650HistoryMar 12, 2021 - 10:42 p.m.
Misinterpretation of malicious XML input
2021-03-1222:42:38
Anonymous
www.npmjs.com
149
0.003 Low
EPSS
Percentile
69.7%
Overview
Impact
xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents.
This may lead to unexpected syntactic changes during XML processing in some downstream applications.
Workarounds
Downstream applications can validate the input and reject the maliciously crafted documents.
Recommendation
Update to 0.5.0 or later
References
Related
debiancve
debiancve
CVE-2021-21366
2021-03-12 17:15:12
redhatcve
redhatcve
CVE-2021-21366
2023-05-29 18:40:08
prion
prion
Input validation
2021-03-12 17:15:00
cve
cve
CVE-2021-21366
2021-03-12 17:15:12
veracode
veracode
Misinterpretation Of Malicious XML Input
2021-03-10 07:22:41
osv
osv
Misinterpretation of malicious XML input
2021-03-12 22:39:39
CVE-2021-21366
2021-03-12 17:15:12
node-xmldom - security update
2023-01-01 00:00:00
github
github
Misinterpretation of malicious XML input
2021-03-12 22:39:39
ubuntucve
ubuntucve
CVE-2021-21366
2021-03-12 00:00:00
cvelist
cvelist
CVE-2021-21366 Misinterpretation of malicious XML input
2021-03-12 00:00:00
nvd
nvd
CVE-2021-21366
2021-03-12 17:15:12
ibm
ibm
Security Bulletin: A security vulnerability in Node.js xmldom and msgpack5 module affects IBM Cloud Pak for Multicloud Management Managed Service
2021-05-13 19:23:30
openvas
openvas
Debian: Security Advisory (DLA-3260-1)
2023-01-02 00:00:00
Ubuntu: Security Advisory (USN-6102-1)
2023-05-25 00:00:00
nessus
nessus
Debian DLA-3260-1 : node-xmldom - LTS security update
2023-01-07 00:00:00
Ubuntu 20.04 LTS / 22.04 LTS : xmldom vulnerabilities (USN-6102-1)
2023-05-24 00:00:00
debian
debian
[SECURITY] [DLA 3260-1] node-xmldom security update
2023-01-01 17:00:48
ubuntu
ubuntu
xmldom vulnerabilities
2023-05-24 00:00:00