CVE-2021-21366 - CVE House
Back to Database
Status published Medium CVE-2021-21366

Misinterpretation of malicious XML input

Vulnerability Description

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This is fixed in version 0.5.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-21366

Credits & Attribution

No credits recorded in the NVD database.

References

More from xmldom

View All →
CVE-2022-39353
xmldom allows multiple root nodes in a DOM
Critical 9.4
CVE-2021-32796
Misinterpretation of malicious XML input in xmldom
Medium 6.5

Affected Vendor

Affected Software

xmldom
Vulnerable Versions:
< 0.5.0

Timeline

Official Publish: March 12th, 2021
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-436 CWE-115

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.