An open index of dependabot pull requests across open source projects.

@xmldom/xmldom

Ecosystem:
npm
Package URL:
pkg:npm/@xmldom/xmldom
Total PRs:
851 Dependabot PRs
Latest PR:
1 day ago
Unique Repositories:
579 repositories
Unique Repos (30 days):
76 repositories
Security Advisories
xmldom: Uncontrolled recursion in XML serialization leads to DoS
GHSA-2v35-w6hq-6mfw CVE-2026-41673 HIGH published about 2 months ago • updated 1 day ago
## Summary Seven recursive traversals in `lib/dom.js` operate without a depth limit. A sufficiently deeply nested DOM tree causes a `RangeError: M...
xmldom has XML injection through unvalidated DocumentType serialization
GHSA-f6ww-3ggp-fr8h CVE-2026-41674 HIGH published about 2 months ago • updated 3 days ago
## Summary The package serializes `DocumentType` node fields (`internalSubset`, `publicId`, `systemId`) verbatim without any escaping or validatio...
xmldom allows multiple root nodes in a DOM
GHSA-crh6-fp67-6883 CVE-2022-39353 CRITICAL published over 3 years ago • updated 3 days ago
### Impact xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` c...
xmldom has XML node injection through unvalidated comment serialization
GHSA-j759-j44w-7fr8 CVE-2026-41672 HIGH published about 2 months ago • updated 1 day ago
## Summary The package allows attacker-controlled comment content to be serialized into XML without validating or neutralizing comment breaking se...
Misinterpretation of malicious XML input
GHSA-5fg8-2547-mr8q CVE-2021-32796 MODERATE published almost 5 years ago • updated 8 days ago
### Impact xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This m...
Recent PRs (filtered by: Patch PRs )
Package Details
Name: @xmldom/xmldom
Ecosystem: npm
PURL Type: npm
Package URL: pkg:npm/@xmldom/xmldom
JSON API: View JSON
Security Advisories

7

Active advisories
CRITICAL 1
HIGH 5
MODERATE 1
View All npm Advisories
Package Information
Description:

A pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

Repository: https://github.com/xmldom/xmldom
Homepage: https://github.com/xmldom/xmldom
Latest Release: 0.9.8
over 1 year ago
Dependent Repos: 85,555
Dependent Packages: 605
Downloads: 46,175,323
Ranking: Top 0.1065% by dependent repos Top 0.048% by downloads Top 0.1006% by dependent pkgs
PR Status
Open 401 (47.1%)
Merged 11 (1.3%)
Closed 432 (50.8%)
PR Types
Minor 63 (7.4%)
Patch 777 (91.3%)
Removal 2 (0.2%)