{"action":"Upgrade xmldom to 0.5.0 or later.","affected":[{"fixed":"0.5.0","introduced":"0"}],"component":"xmldom","cve_ids":["CVE-2021-21366"],"ecosystem":"npm","epss":0.0134,"exploited":false,"fixed_versions":["0.5.0"],"ghsa_id":"GHSA-h6q6-9hqw-rwfv","id":"tcs_01M5KFTCC24QBJA7VJPHMWZ47H","modified_at":"2026-09-10T03:49:02.254678560Z","published_at":"2021-03-12T22:39:39Z","references":["https://osv.dev/vulnerability/GHSA-h6q6-9hqw-rwfv","https://github.com/xmldom/xmldom/security/advisories/GHSA-h6q6-9hqw-rwfv","https://nvd.nist.gov/vuln/detail/CVE-2021-21366","https://github.com/xmldom/xmldom/commit/d4201b9dfbf760049f457f9f08a3888d48835135","https://github.com/xmldom/xmldom","https://github.com/xmldom/xmldom/releases/tag/0.5.0","https://lists.debian.org/debian-lts-announce/2023/01/msg00000.html","https://www.npmjs.com/package/xmldom"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-h6q6-9hqw-rwfv","url":"https://osv.dev/vulnerability/GHSA-h6q6-9hqw-rwfv"}],"summary":"Misinterpretation of malicious XML input"}