Junglewise Threat Intelligence

CVE-2021-32796: xmldom improper XML character escaping in element serialization

CVE-2021-32796 · Severity: low · CVSS 3.1 · Published 2021-08-03

Technologies: @xmldom/xmldom (npm), xmldom (npm). Vendors: npm.

Executive brief

xmldom is a popular JavaScript library that parses and serializes XML documents. The library does not properly escape special characters when serializing XML elements that have been detached from their document tree. An attacker can craft malicious XML input that changes meaning after being parsed and re-serialized—for example, a SAML authentication message could be subtly altered to appear valid while conveying a different user identity, potentially bypassing authentication controls.

Technical details

This vulnerability is a character-escaping bug (CWE-116) in xmldom's XML serialization logic. When an XML element is removed from its ancestor document and then serialized, special characters in the element and its descendants are not correctly escaped in the output. This causes the serialized XML to have different semantics than the original—a round-trip parse-serialize-parse cycle can result in a structurally different document tree. The vulnerability affects all versions up to 0.6.0. Exploitation requires no authentication and is triggered by parsing maliciously crafted XML documents. The practical impact mirrors similar vulnerabilities discovered in Go's encoding/xml, REXML, and others: applications that rely on XML integrity for security decisions (especially SAML SSO) can have their trust model broken by silent XML mutation. The vulnerability is fixed in @xmldom/xmldom version 0.7.0 and later; the original xmldom package on npm is no longer maintained.

Affected products

  • xmldom xmldom <=0.6.0
  • xmldom @xmldom/xmldom <0.7.0

Timeline

  • 2021-07-27: disclosed
  • 2021-08-03: advisory
  • 2021-08-02: patched: @xmldom/xmldom version 0.7.0 released

References

Related threats