vulnerability
Ubuntu: (CVE-2021-32796): node-xmldom vulnerability
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 5 | (AV:N/AC:L/Au:N/C:N/I:P/A:N) | Jul 27, 2021 | Jun 26, 2025 | Aug 18, 2025 |
Severity
5
CVSS
(AV:N/AC:L/Au:N/C:N/I:P/A:N)
Published
Jul 27, 2021
Added
Jun 26, 2025
Modified
Aug 18, 2025
Description
xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This issue has been resolved in version 0.7.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
Solution
no-fix-ubuntu-package
References
- CVE-2021-32796
- https://attackerkb.com/topics/CVE-2021-32796
- CWE-116
- CWE-91
- URL-https://github.com/xmldom/xmldom/commit/7b4b743917a892d407356e055b296dcd6d107e8b
- URL-https://github.com/xmldom/xmldom/security/advisories/GHSA-5fg8-2547-mr8q
- URL-https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/
- URL-https://www.cve.org/CVERecord?id=CVE-2021-32796
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.