CVE-2021-21366: medium-severity vulnerability in xmldom
Misinterpretation of malicious XML input
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The xmldom library doesn't properly handle specially crafted XML documents when parsing and converting them back to text, which can cause unexpected changes in the document structure. This could allow an attacker to alter XML content in ways that bypass security checks in applications using this library.
xmldom ≤0.4.0 fails to correctly preserve system identifiers, FPIs, and namespaces during repeated parse-serialize cycles on maliciously crafted XML. An unauthenticated attacker can supply malicious XML input that, when processed by vulnerable downstream applications, undergoes syntactic transformation that may circumvent validation logic or security policies (CWE-115: Misinterpreted Input, CWE-436: Interpretation Conflict).
In the same product, most dangerous first.