@xmldom/xmldom@0.8.1

@xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the parseElementStartPart function and normalization. An attacker can cause excessive resource consumption by providing specially crafted XML input that triggers repeated rescanning or merging of adjacent text nodes.

Upgrade @xmldom/xmldom to version 0.8.15, 0.9.12 or higher.

@xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom

Affected versions of this package are vulnerable to XML Injection via the createElement method. An attacker can inject arbitrary attributes, elements, or processing instructions into serialized XML or HTML by supplying crafted tag names, potentially leading to execution of malicious scripts in environments that consume the serialized output.

Upgrade @xmldom/xmldom to version 0.8.14, 0.9.11 or higher.

@xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the serializeToString function. An attacker can inject arbitrary XML markup by creating an EntityReference node with an invalid nodeName and directly serializing it with requireWellFormed: true.

Note: This is only exploitable if the application explicitly creates and serializes an EntityReference node, as the parser does not generate these nodes by default and element-child insertion is rejected.

Upgrade @xmldom/xmldom to version 0.8.15, 0.9.12 or higher.

@xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the DOMParser.parseFromString function. An attacker can cause significant performance degradation and stall the Node.js event loop by submitting XML documents containing elements with a large number of unique attributes.

Upgrade @xmldom/xmldom to version 0.8.15, 0.9.12 or higher.

@xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom

Affected versions of this package are vulnerable to XML Injection in the Document.createProcessingInstruction function. An attacker can inject arbitrary XML structure by supplying specially crafted input containing invalid XML-name characters, which can break the processing-instruction boundary during serialization.

Upgrade @xmldom/xmldom to version 0.8.15, 0.9.12 or higher.

@xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the appendElement function in lib/sax.js when handling XML documents with deeply nested elements that declare new namespace prefixes. An attacker can cause excessive memory consumption by submitting specially crafted XML input that leads to quadratic growth in namespace-map storage, potentially resulting in process heap exhaustion.

Upgrade @xmldom/xmldom to version 0.8.15, 0.9.12 or higher.

@xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the parseFromString function. An attacker can cause excessive resource consumption and stall the event loop by submitting specially crafted XML input containing long whitespace runs in end tags.

Upgrade @xmldom/xmldom to version 0.8.15 or higher.

@xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom

Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input via the parseFromString function. An attacker can bypass well-formedness validation by submitting XML data containing an end tag with a line break and trailing content, which is silently accepted and processed without error reporting.

Upgrade @xmldom/xmldom to version 0.8.15, 0.9.12 or higher.

@xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom

Affected versions of this package are vulnerable to XML Injection via improper validation of the name property in the DocumentType node when requireWellFormed is set to true. An attacker can inject arbitrary markup into the output by supplying a crafted value to the name property, potentially leading to the injection of sibling elements or manipulation of the document structure.

Upgrade @xmldom/xmldom to version 0.8.15, 0.9.12 or higher.

@xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom

Affected versions of this package are vulnerable to XML Injection via the createProcessingInstruction function. An attacker can inject arbitrary XML nodes into the serialized output by supplying specially crafted data containing the PI-closing sequence, which is not validated or neutralized during serialization. This can alter the structure and meaning of generated XML documents, potentially impacting workflows that store, forward, sign, or parse XML.

Note:

This is only exploitable if the serialization is performed without passing the { requireWellFormed: true } option.

Upgrade @xmldom/xmldom to version 0.8.13, 0.9.10 or higher.

@xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom

Affected versions of this package are vulnerable to XML Injection in the serialization of DocumentType nodes when attacker-controlled values are provided to the publicId, systemId, or internalSubset fields. An attacker can inject arbitrary XML markup into the serialized output by supplying specially crafted input to these fields, potentially leading to the injection of malicious DOCTYPE declarations or markup outside the intended context.

Note:

This is only exploitable if untrusted data is passed programmatically to createDocumentType or written directly to the relevant properties and then serialized without enabling strict validation.

Upgrade @xmldom/xmldom to version 0.8.13, 0.9.10 or higher.

@xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom

Affected versions of this package are vulnerable to Uncontrolled Recursion in the recursive processing of deeply nested XML documents by several DOM-related operations, including normalize, serializeToString, getElementsByTagName, getElementsByTagNameNS, getElementsByClassName, getElementById, cloneNode, importNode, textContent, and isEqualNode. An attacker can cause the application to crash or become unresponsive by submitting a valid, deeply nested XML payload that triggers uncontrolled recursion and stack exhaustion.

Upgrade @xmldom/xmldom to version 0.8.13, 0.9.10 or higher.

@xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom

Affected versions of this package are vulnerable to XML Injection due to unvalidated comment serialization. When an application uses the package to create an XML comment from untrusted user input, the package fails to sanitize comment-breaking sequences (like -->). An attacker can input --> to terminate the comment prematurely. Once the comment is broken out of, any text the attacker places after the --> is treated as "live" XML markup by the serializer rather than harmless comment text.

Upgrade @xmldom/xmldom to version 0.8.13, 0.9.10 or higher.

@xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom

Affected versions of this package are vulnerable to XML Injection via the XMLSerializer() function. An attacker can manipulate the structure and integrity of generated XML documents by injecting attacker-controlled markup containing the CDATA terminator ]]> through CDATA section content, which is not properly validated or sanitized during serialization. This can result in unauthorized XML elements or attributes being inserted, potentially leading to business logic manipulation or privilege escalation in downstream consumers.

Upgrade @xmldom/xmldom to version 0.8.12, 0.9.9 or higher.

@xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom

Affected versions of this package are vulnerable to Improper Input Validation due to parsing XML that is not well-formed, and contains multiple top-level elements. All the root nodes are being added to the childNodes collection of the Document, without reporting or throwing any error.

Upgrade @xmldom/xmldom to version 0.7.7, 0.8.4, 0.9.0-beta.4 or higher.