UBUNTU-CVE-2021-21366

    Dashboard / Vulnerabilities / UBUNTU-CVE-2021-21366

    UBUNTU-CVE-2021-21366

    Published: 12 Mar 2021Last Modified: 4 Feb 2026
    Upstream:
    CVE-2021-21366
    Aliases:
    USN-6102-1

    Summary:

    Details: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This is fixed in version 0.5.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.

    References: https://ubuntu.com/security/CVE-2021-21366, https://github.com/xmldom/xmldom/security/advisories/GHSA-h6q6-9hqw-rwfv, https://github.com/xmldom/xmldom/commit/d4201b9dfbf760049f457f9f08a3888d48835135, https://github.com/xmldom/xmldom/releases/tag/0.5.0, https://www.npmjs.com/package/xmldom, https://ubuntu.com/security/notices/USN-6102-1, https://www.cve.org/CVERecord?id=CVE-2021-21366

    Affected packages

    Package

    Name: node-xmldom

    Purl: pkg:deb/ubuntu/[email protected]+ds-1+deb10u2build0.20.04.1?arch=source&distro=focal

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -0.1.27+ds-1+deb10u2build0.20.04.1

    Affected versions

    0.1.27+ds-1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    UBUNTU-CVE-2021-21366 | CVE-DB