An open index of dependabot pull requests across open source projects.

@xmldom/xmldom

Ecosystem:
npm
Package URL:
pkg:npm/@xmldom/xmldom
Total PRs:
866 Dependabot PRs
Latest PR:
20 days ago
Unique Repositories:
591 repositories
Unique Repos (30 days):
11 repositories
Security Advisories
Misinterpretation of malicious XML input
GHSA-5fg8-2547-mr8q CVE-2021-32796 MODERATE published almost 5 years ago • updated about 1 month ago
### Impact xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This m...
xmldom has XML injection through unvalidated DocumentType serialization
GHSA-f6ww-3ggp-fr8h CVE-2026-41674 HIGH published 3 months ago • updated 2 days ago
## Summary The package serializes `DocumentType` node fields (`internalSubset`, `publicId`, `systemId`) verbatim without any escaping or validatio...
xmldom has XML node injection through unvalidated comment serialization
GHSA-j759-j44w-7fr8 CVE-2026-41672 HIGH published 3 months ago • updated 8 days ago
## Summary The package allows attacker-controlled comment content to be serialized into XML without validating or neutralizing comment breaking se...
xmldom allows multiple root nodes in a DOM
GHSA-crh6-fp67-6883 CVE-2022-39353 CRITICAL published over 3 years ago • updated about 1 hour ago
### Impact xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the `childNodes` c...
xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion
GHSA-wh4c-j3r5-mjhp CVE-2026-34601 HIGH published 4 months ago • updated about 5 hours ago
## Summary `@xmldom/xmldom` allows attacker-controlled strings containing the CDATA terminator `]]>` to be inserted into a `CDATASection` node. Du...
Recent PRs (filtered by: Patch PRs )
Package Details
Name: @xmldom/xmldom
Ecosystem: npm
PURL Type: npm
Package URL: pkg:npm/@xmldom/xmldom
JSON API: View JSON
Security Advisories

7

Active advisories
CRITICAL 1
HIGH 5
MODERATE 1
View All npm Advisories
Package Information
Description:

A pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

Repository: https://github.com/xmldom/xmldom
Homepage: https://github.com/xmldom/xmldom
Latest Release: 0.9.8
over 1 year ago
Dependent Repos: 85,555
Dependent Packages: 605
Downloads: 46,175,323
Ranking: Top 0.1065% by dependent repos Top 0.048% by downloads Top 0.1006% by dependent pkgs
PR Status
Open 408 (47.1%)
Merged 11 (1.3%)
Closed 440 (50.8%)
PR Types
Minor 65 (7.5%)
Patch 789 (91.1%)
Removal 2 (0.2%)