npm - OSV

GHSA-c7q8-3ch8-vqpv

npm/@xmldom/xmldom
npm/xmldom

xmldom: Processing Instruction Target Injection Bypasses requireWellFormed 08 Sep

Fix available
Severity - 8.7 (High)

GHSA-jxjr-3g7g-3944

npm/@xmldom/xmldom

xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator 08 Sep

Fix available
Severity - 8.7 (High)

GHSA-27p8-2357-5qqv

npm/@xmldom/xmldom
npm/xmldom

xmldom: DocType `name` Injection Bypasses requireWellFormed 08 Sep

Fix available
Severity - 8.7 (High)

GHSA-3px3-54cx-rmw9

npm/@xmldom/xmldom

xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path 08 Sep

Fix available
Severity - 8.7 (High)

GHSA-vr34-hp96-76pp

npm/@xmldom/xmldom

xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator 08 Sep

Fix available
Severity - 8.7 (High)

GHSA-6h8r-xr42-gp59

npm/@xmldom/xmldom
npm/xmldom

xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content 08 Sep

Fix available
Severity - 6.9 (Medium)

GHSA-8344-3jmq-59r6

npm/@xmldom/xmldom
npm/xmldom

xmldom: Quadratic-time attribute deduplication 08 Sep

Fix available
Severity - 8.7 (High)

GHSA-x4fp-j954-r2f4

npm/@xmldom/xmldom

xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser 08 Sep

Fix available
Severity - 8.7 (High)

GHSA-965w-775f-mr7g

npm/@xmldom/xmldom
npm/xmldom

xmldom: Quadratic-memory consumption 08 Sep

Fix available
Severity - 8.7 (High)

GHSA-93r5-fhx6-vmg9

npm/@xmldom/xmldom
npm/xmldom

xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge 08 Sep

Fix available
Severity - 8.7 (High)

GHSA-6mj3-qw4j-hgrw

npm/@xmldom/xmldom

xmldom: HTML raw-text closing-tag case mismatch causes output amplification 08 Sep

Fix available
Severity - 8.7 (High)

GHSA-g53g-w8rj-fmg7

npm/@xmldom/xmldom

xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions 08 Sep

Fix available
Severity - 8.7 (High)

GHSA-w2rr-34g9-rvrj

npm/@xmldom/xmldom
npm/xmldom

xmldom: Element name injection via createElement() bypasses requireWellFormed 08 Sep

Fix available
Severity - 8.7 (High)

GHSA-4w3w-2rp5-g8jm

npm/@xmldom/xmldom
npm/xmldom

xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed 08 Sep

Fix available
Severity - 8.7 (High)

GHSA-6gmq-8vp8-gcm6

npm/@xmldom/xmldom
npm/xmldom

xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization 02 Sep

Fix available
Severity - 6.3 (Medium)

GHSA-2v35-w6hq-6mfw

npm/@xmldom/xmldom
npm/xmldom

xmldom: Uncontrolled recursion in XML serialization leads to DoS 22 Apr

Fix available
Severity - 8.7 (High)

Vulnerabilities