CVE-2021-32796: xmldom_project xmldom Improper Encoding or Escaping of Output
Vulnerability summary
CVE-2021-32796 is a medium (CVSS 6.5) Improper Encoding or Escaping of Output vulnerability in xmldom_project xmldom. EPSS estimates a 1.36% chance of exploitation in the next 30 days, higher than 71.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 27-07-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This issue has been resolved in version 0.7.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
CVSS metrics
7 scores · 6 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NDiffers
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NDiffers
- OSV · NpmEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NDiffers
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NDiffers
EPSS trend
Probability
1.36%
Chance of exploitation in the next 30 days
Percentile
71%
Versus all other CVEs
30-day change
0.00 pp
From 1.36% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-116Improper Encoding or Escaping of OutputThe product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
- CWE-91XML Injection (aka Blind XPath Injection)The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
Affected systems
Chainguard2 products
- wazuh-dashboard-security-plugin< 4.14.6-r3
- wazuh-dashboard-security-plugin-fips< 4.14.6-r1
@xmldom1 product
- xmldom< 0.7.0
Debian1 product
- node-xmldom< 0.7.3-1
Npm1 product
- xmldom≤ 0.6.0
Ubuntu1 product
- node-xmldomAll versions (No fix recorded)
Xmldom1 product
- xmldom< 0.7.0
Xmldom_project1 product
- xmldom< 0.7.0
7 vendors · 8 products
References
11 links- mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/X Refsource MISCREPORTAdvisoryNot ApplicableThird Party Advisory
- github.com/xmldom/xmldom/security/advisories/GHSA-5fg8-2547-mr8qX Refsource CONFIRMREPORTWEBAdvisoryThird Party Advisory
- github.com/xmldom/xmldom/commit/7b4b743917a892d407356e055b296dcd6d107e8bX Refsource MISCREPORTWEBFIXPatchThird Party Advisory
- github.com/xmldom/xmldomPACKAGE