444 matches found
xmldom: Processing Instruction Target Injection Bypasses requireWellFormed
Summary Document.createProcessingInstruction in @xmldom/xmldom performs no validation on the target parameter. The requireWellFormed: true serializer option validates only for : in the target and a case-insensitive xml prefix, but does not check for characters. A in the target breaks the processi...
EUVD-2026-69239
xmldom: Processing Instruction Target Injection Bypasses requireWellFormed...
EUVD-2026-69241
xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator...
xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator
Summary An embedded line terminator bypasses the requireWellFormed serializer check for element and attribute names. The check was added to fix GHSA-w2rr-34g9-rvrj and GHSA-4w3w-2rp5-g8jm; a name whose first line is well-formed slips past it and is serialized verbatim, so the characters after the...
EUVD-2026-69219
xmldom: DocType name Injection Bypasses requireWellFormed...
xmldom: DocType `name` Injection Bypasses requireWellFormed
Summary The @xmldom/xmldom serializer emits DocumentType.name verbatim into the declaration with no well-formedness guard. GHSA-f6ww-3ggp-fr8h CVE-2026-41674 hardened the serializer's requireWellFormed path for a DocumentType's sibling fields — publicId, systemId, and internalSubset — but it did...
xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path
Summary An embedded line terminator bypasses xmldom's always-on, WHATWG-mandated creation-time name validation. createElementNS, createAttributeNS, createDocumentType, and createAttribute should reject a malformed qualified name with InvalidCharacterError, but a name whose first line is well-form...
EUVD-2026-69220
xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path...
EUVD-2026-69244
xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator...
xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator
Summary An embedded line terminator bypasses the requireWellFormed serializer check for a DocumentType's publicId and systemId. The check was added to fix GHSA-f6ww-3ggp-fr8h; an id whose first line is a valid literal slips past it and is emitted verbatim into the declaration, so the markup after...
xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content
Summary xmldom's parser silently accepts a not-well-formed end tag whose valid name is followed by trailing content — e.g. . The element is closed, the trailing content is discarded, and no error is reported, even though the XML end-tag production allows only optional whitespace after the name an...
EUVD-2026-69225
xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content...
EUVD-2026-69231
xmldom: Quadratic-time attribute deduplication...
xmldom: Quadratic-time attribute deduplication
Summary xmldom builds the attribute collection of every parsed element by inserting attributes one at a time into a DOM NamedNodeMap. Each insertion first performs a linear scan of all already-inserted attributes to enforce the DOM uniqueness rule no two attributes with the same qualified name /...
GHSA-8344-3JMQ-59R6 xmldom: Quadratic-time attribute deduplication
Summary xmldom builds the attribute collection of every parsed element by inserting attributes one at a time into a DOM NamedNodeMap. Each insertion first performs a linear scan of all already-inserted attributes to enforce the DOM uniqueness rule no two attributes with the same qualified name /...
EUVD-2026-69248
xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser...
xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser
Summary On the @xmldom/xmldom 0.8.x line, parsing an XML end tag whose name is followed by a long run of whitespace and then a non-whitespace character triggers quadratic-time regular-expression backtracking ReDoS, so a single small crafted end tag stalls the Node.js event loop. It is reachable...
xmldom: Quadratic-memory consumption
Summary When an element declares a namespace prefix, xmldom copies the entire in-scope namespace map into a fresh object and keeps that copy on the element while it is open on the parse stack. A crafted document that nests N elements, each declaring one unique prefix, therefore drives the parser ...