@xmldom/xmldom

Misinterpretation of malicious XML input

xmldom allows multiple root nodes in a DOM

Withdrawn: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in @xmldom/xmldom and xmldom

xmldom has XML injection through unvalidated DocumentType serialization

xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion

xmldom: Uncontrolled recursion in XML serialization leads to DoS

xmldom has XML node injection through unvalidated comment serialization

xmldom has XML node injection through unvalidated processing instruction serialization