CVE-2021-32796 - CVE House
Back to Database
Status published Medium CVE-2021-32796

Misinterpretation of malicious XML input in xmldom

Vulnerability Description

xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This issue has been resolved in version 0.7.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-32796

Credits & Attribution

No credits recorded in the NVD database.

References

More from xmldom

View All →
CVE-2022-39353
xmldom allows multiple root nodes in a DOM
Critical 9.4
CVE-2021-21366
Misinterpretation of malicious XML input
Medium 4.3

Affected Vendor

Affected Software

xmldom
Vulnerable Versions:
< 0.7.0

Timeline

Official Publish: July 27th, 2021
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-116

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1565.002 Stored Data Manipulation
Impact