CVE-2021-32796

xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This issue has been resolved in version 0.7.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.

• CWE-116
• CWE-91
• CWE-116

• https://github.com/xmldom/xmldom/commit/7b4b743917a892d407356e055b296dcd6d107e8bPatch, Third Party Advisory
• https://github.com/xmldom/xmldom/security/advisories/GHSA-5fg8-2547-mr8qThird Party Advisory
• https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/Not Applicable, Third Party Advisory
• https://github.com/xmldom/xmldom/commit/7b4b743917a892d407356e055b296dcd6d107e8bPatch, Third Party Advisory
• https://github.com/xmldom/xmldom/security/advisories/GHSA-5fg8-2547-mr8qThird Party Advisory
• https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/Not Applicable, Third Party Advisory

Published

Jul 27, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32790Woocommerce is an open source eCommerce plugin for WordPress…4.9
• CVE-2021-32791mod_auth_openidc is an authentication/authorization module f…5.9
• CVE-2021-32792mod_auth_openidc is an authentication/authorization module f…6.1
• CVE-2021-32793Pi-hole's Web interface provides a central location to manag…4.8
• CVE-2021-32794ArchiSteamFarm is a C# application with primary purpose of i…7.5
• CVE-2021-32795ArchiSteamFarm is a C# application with primary purpose of i…5.9
• CVE-2021-32797JupyterLab is a user interface for Project Jupyter which wil…9.6
• CVE-2021-32798The Jupyter notebook is a web-based notebook environment for…9.6
• CVE-2021-32800Nextcloud server is an open source, self hosted personal clo…8.1
• CVE-2021-32801Nextcloud server is an open source, self hosted personal clo…5.5
• CVE-2021-32802Nextcloud server is an open source, self hosted personal clo…9.8
• CVE-2021-32803The npm package "tar" (aka node-tar) before versions 6.1.2, …8.1