CVE-2021-21366: Vulnerability in xmldom package - Misinterpretation of malicious XML input
Summary
Your scan reports xmldom 0.1.31. Fixed in 0.5.0.
CVE-2021-21366: Misinterpretation of malicious XML input. Affects xmldom versions < 0.5.0. Fixed in 0.5.0. How to fix ↓
Also tracked for
- node-xmldom · Debian:11
The same CVE-2021-21366 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Background
The xmldom package is an npm package that provides a pure JavaScript implementation of the W3C DOM Level 1 Core and the XML DOM Level 2 Core. It allows developers to parse and manipulate XML documents using JavaScript. The package is widely used in various applications and libraries for XML processing.
However, versions 0.4.0 and older of xmldom suffer from a vulnerability that misinterprets malicious XML input. When repeatedly parsing and serializing maliciously crafted documents, these versions do not correctly preserve system identifiers, FPIs, or namespaces. This can result in unexpected syntactic changes during XML processing in downstream applications, potentially leading to security issues or incorrect behavior.
Vulnerability Detail
The vulnerability in xmldom versions 0.4.0 and older arises from the incorrect preservation of system identifiers, FPIs, and namespaces when parsing and serializing malicious XML documents. This can be exploited by an attacker to manipulate the XML structure in unexpected ways, potentially bypassing security measures or causing incorrect behavior in downstream applications that rely on the integrity of the XML data.
The impact of this vulnerability can vary depending on the specific usage of xmldom in different applications. However, it is important to note that the vulnerability can lead to unexpected syntactic changes during XML processing, which may have security implications or cause applications to behave incorrectly.
How To Fix
Latest published version: 0.6.0 as of 22 Oct 2026
npm install xmldom@0.6.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.0
This is the first release that contains the fix.
npm install xmldom@0.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the fixed version is not immediately feasible, downstream applications can implement input validation to detect and reject maliciously crafted XML documents. By validating the XML input and ensuring that system identifiers, FPIs, and namespaces are correctly preserved, applications can mitigate the risk of exploitation. However, implementing input validation can be complex and may not provide the same level of security as updating to the fixed version.
Conclusion
The vulnerability in xmldom versions 0.4.0 and older can result in unexpected syntactic changes during XML processing, potentially leading to security issues or incorrect behavior in downstream applications. It is recommended to update to version 0.5.0 (or newer once it is released) to address the vulnerability. If immediate update is not feasible, implementing input validation can provide some mitigation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for xmldom →
FAQ
The impact of this vulnerability can vary depending on the specific usage of xmldom in different applications. However, it can lead to unexpected syntactic changes during XML processing, potentially resulting in security issues or incorrect behavior.
To fix this vulnerability, it is recommended to update the xmldom package to version 0.5.0 (or newer once it is released). This version includes the necessary fixes to correctly preserve system identifiers, FPIs, and namespaces when parsing and serializing XML documents.
If updating to the fixed version is not immediately feasible, downstream applications can implement input validation to detect and reject maliciously crafted XML documents. However, this may not provide the same level of security as updating to the fixed version.
There are no known public exploits for this vulnerability at the time of this advisory. However, it is important to address the vulnerability promptly to mitigate any potential risks.
For more information, you can refer to the advisory on the GitHub Security Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/03/GHSA-h6q6-9hqw-rwfv/GHSA-h6q6-9hqw-rwfv.json
References
Related vulnerabilities
Recent vulnerabilities recorded for xmldom.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.