https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 05:27:48 +0000 https://db.gcve.eu/vuln/ghsa-f6ww-3ggp-fr8h <p><strong>Affected:</strong> npm: @xmldom/xmldom, npm: xmldom</p> <p>## Summary</p> <p>The package serializes `DocumentType` node fields (`internalSubset`, `publicId`, `systemId`) verbatim without any escaping or validation. When these fields are set programmatically to attacker-controlled strings, `XMLSerializer.serializeToString` can produce output where the DOCTYPE declaration is terminated early and arbitrary markup appears outside it.</p> <p>---</p> <p>## Details</p> <p>`DOMImplementation.createDocumentType(qualifiedName, publicId, systemId, internalSubset)` validates only `qualifiedName` against the XML QName production. The remaining three arguments are stored as-is with no validation.</p> <p>The XMLSerializer emits `DocumentType` nodes as:</p> <p>``` &lt;!DOCTYPE name[ PUBLIC pubid][ SYSTEM sysid][ [internalSubset]]&gt; ```</p> <p>All fields are pushed into the output buffer verbatim — no escaping, no quoting added.</p> <p>**`internalSubset` injection:** The serializer wraps `internalSubset` with ` [` and `]`. A value containing `]&gt;` closes the internal subset and the DOCTYPE declaration at the injection point. Any content after `]&gt;` in `internalSubset` appears outside the DOCTYPE in the serialized output as raw XML markup. Reported by @TharVid (GHSA-f6ww-3ggp-fr8h). Affected: `@xmldom/xmldom` ≥ 0.9.0 via `createDocumentType` API; 0.8.x only via direct property write.</p> <p>**`publicId` injection:** The serializer emits `publicId` verbatim after `PUBLIC` with no quoting added. A value containing an injected system identifier (e.g., `&#34;pubid&#34; SYSTEM &#34;evil&#34;`) breaks the intended quoting context,…</p> <p><strong>Affected:</strong> npm: @xmldom/xmldom, npm: xmldom</p> <p>## Summary</p> <p>The package serializes `DocumentType` node fields (`internalSubset`, `publicId`, `systemId`) verbatim without any escaping or validation. When these fields are set programmatically to attacker-controlled strings, `XMLSerializer.serializeToString` can produce output where the DOCTYPE declaration is terminated early and arbitrary markup appears outside it.</p> <p>---</p> <p>## Details</p> <p>`DOMImplementation.createDocumentType(qualifiedName, publicId, systemId, internalSubset)` validates only `qualifiedName` against the XML QName production. The remaining three arguments are stored as-is with no validation.</p> <p>The XMLSerializer emits `DocumentType` nodes as:</p> <p>``` &lt;!DOCTYPE name[ PUBLIC pubid][ SYSTEM sysid][ [internalSubset]]&gt; ```</p> <p>All fields are pushed into the output buffer verbatim — no escaping, no quoting added.</p> <p>**`internalSubset` injection:** The serializer wraps `internalSubset` with ` [` and `]`. A value containing `]&gt;` closes the internal subset and the DOCTYPE declaration at the injection point. Any content after `]&gt;` in `internalSubset` appears outside the DOCTYPE in the serialized output as raw XML markup. Reported by @TharVid (GHSA-f6ww-3ggp-fr8h). Affected: `@xmldom/xmldom` ≥ 0.9.0 via `createDocumentType` API; 0.8.x only via direct property write.</p> <p>**`publicId` injection:** The serializer emits `publicId` verbatim after `PUBLIC` with no quoting added. A value containing an injected system identifier (e.g., `&#34;pubid&#34; SYSTEM &#34;evil&#34;`) breaks the intended quoting context,…</p> https://db.gcve.eu/vuln/ghsa-f6ww-3ggp-fr8h