Is CVE-2021-32796 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-32796 being exploited in the wild.

How severe is CVE-2021-32796?

Low severity, with a CVSS score of 3.1, published 3 August 2021.

Which products and versions are affected?

@xmldom/xmldom (npm) SEMVER:introduced=0,fixed=0.7.0; xmldom (npm) SEMVER:introduced=0,last_affected=0.6.0.

Is there a fix for CVE-2021-32796?

Yes. @xmldom/xmldom (npm): upgrade to 0.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-32796 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2021-32796?

Check whether you run @xmldom/xmldom (npm) or xmldom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-32796: xmldom improper XML character escaping in element serialization

CVE-2021-32796 · Severity: low · CVSS 3.1 · Published 2021-08-03

xmldom is a popular JavaScript library that parses and serializes XML documents. The library does not properly escape special characters when serializing XML elements that have been detached from their document tree. An attacker can craft malicious XML input that changes meaning after being parsed and re-serialized—for example, a SAML authentication message could be subtly altered to appear valid while conveying a different user identity, potentially bypassing authentication controls.

Technologies: @xmldom/xmldom (npm), xmldom (npm). Vendors: npm.

Quick answers

Is CVE-2021-32796 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-32796 being exploited in the wild.
How severe is CVE-2021-32796?: Low severity, with a CVSS score of 3.1, published 3 August 2021.
Which products and versions are affected?: @xmldom/xmldom (npm) SEMVER:introduced=0,fixed=0.7.0; xmldom (npm) SEMVER:introduced=0,last_affected=0.6.0.
Is there a fix for CVE-2021-32796?: Yes. @xmldom/xmldom (npm): upgrade to 0.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-32796 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2021-32796?: Check whether you run @xmldom/xmldom (npm) or xmldom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@xmldom/xmldom (npm): upgrade to 0.7.0 or later
```
npm install @xmldom/xmldom@0.7.0
```

Technical details

This vulnerability is a character-escaping bug (CWE-116) in xmldom's XML serialization logic. When an XML element is removed from its ancestor document and then serialized, special characters in the element and its descendants are not correctly escaped in the output. This causes the serialized XML to have different semantics than the original—a round-trip parse-serialize-parse cycle can result in a structurally different document tree. The vulnerability affects all versions up to 0.6.0. Exploitation requires no authentication and is triggered by parsing maliciously crafted XML documents. The practical impact mirrors similar vulnerabilities discovered in Go's encoding/xml, REXML, and others: applications that rely on XML integrity for security decisions (especially SAML SSO) can have their trust model broken by silent XML mutation. The vulnerability is fixed in @xmldom/xmldom version 0.7.0 and later; the original xmldom package on npm is no longer maintained.

Affected products

xmldom xmldom <=0.6.0
xmldom @xmldom/xmldom <0.7.0

Identifiers

CVE-2021-32796
GHSA-5fg8-2547-mr8q

Timeline

2021-07-27: disclosed
2021-08-03: advisory
2021-08-02: patched: @xmldom/xmldom version 0.7.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.