Quick answers
- Is CVE-2021-21366 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2021-21366 being exploited in the wild.
- How severe is CVE-2021-21366?
- Low severity, with a CVSS score of 3.1, published 12 March 2021.
- Which products and versions are affected?
- xmldom (npm) SEMVER:introduced=0,fixed=0.5.0.
- Is there a fix for CVE-2021-21366?
- Yes. xmldom (npm): upgrade to 0.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2021-21366 attacked?
- It is attacked over the network.
- Am I affected by CVE-2021-21366?
- Check whether you run xmldom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- xmldom (npm): upgrade to 0.5.0 or later
npm install xmldom@0.5.0
Technical details
The vulnerability is a misinterpretation of malicious XML input (CWE-115, CWE-436) in xmldom's DOM parsing and serialization logic. The root cause is improper preservation of XML system identifiers (DOCTYPE declarations), FPIs (Formal Public Identifiers), and namespace declarations when repeatedly parsing and serializing specially crafted XML documents. An attacker can craft malicious XML that, when processed by xmldom and re-serialized, results in syntactic changes to the document structure. No authentication or special privileges are required; the attack requires user interaction (UI:R). The impact is limited to integrity (I:L) with no confidentiality or availability impact. The fix was released in version 0.5.0.
Affected products
- xmldom xmldom <=0.4.0
Identifiers
- CVE-2021-21366
- GHSA-h6q6-9hqw-rwfv
Timeline
- 2021-03-12: disclosed
- 2021-03-12: patched: Fixed in version 0.5.0