@xmldom/xmldom 0.9.11
PkgFire would install this release with a warning.·Checked 3 hours ago·Published 12 August 2026
Why
-
warnVulnerability
xmldom: DocType `name` Injection Bypasses requireWellFormed (fixed in 0.9.12)
-
warnVulnerability
xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path (fixed in 0.9.12)
-
warnVulnerability
xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization (fixed in 0.9.12)
-
warnVulnerability
xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content (fixed in 0.9.12)
-
warnVulnerability
xmldom: HTML raw-text closing-tag case mismatch causes output amplification (fixed in 0.9.12)
-
warnVulnerability
xmldom: Quadratic-time attribute deduplication (fixed in 0.9.12)
-
warnVulnerability
xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge (fixed in 0.9.12)
-
warnVulnerability
xmldom: Quadratic-memory consumption (fixed in 0.9.12)
-
warnVulnerability
xmldom: Processing Instruction Target Injection Bypasses requireWellFormed (fixed in 0.9.12)
-
warnVulnerability
xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator (fixed in 0.9.12)
-
warnVulnerability
xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator (fixed in 0.9.12)
Provenance
A registry signature proves the registry served these bytes unaltered. Build provenance proves which workflow built them from which commit; a stolen publishing token can fake the first but not the second.
- Signature
- Verified against the registry's key
- Build provenance
- None, and no earlier version had any
What the code does
On its own this is weak signal: plenty of honest libraries read files or talk to the network. What PkgFire watches is a release gaining something the one before it did not.
Source patterns
Patterns found in the source, including those malware is known to use.
Other checked releases
Check every dependency before it installs
This page is one release. PkgFire checks every package in your lockfile, on every install and in every pull request, and blocks the bad ones before they run.