CVE-2026-34601
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to 0.8.12 and 0.9.9, an attacker can insert a string containing the CDATA terminator ]]> into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without rejecting or safely splitting the terminator, enabling XML structure injection and downstream business-logic manipulation. The issue is patched in xmldom 0.6.0 and @xmldom/xmldom 0.8.12 and 0.9.9.
Risk Assessment
An attacker can inject malicious XML into output data, potentially leading to business-logic manipulation or XML injection attacks.
Recommendation
Update xmldom to version 0.6.0 or later, and @xmldom/xmldom to version 0.8.12 or 0.9.9.
Other vulnerabilities in xmldom
See all- CVE-2026-41674High
Vulnerability in @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and earlier. The package serializes DocumentType fields (internalSubset, publicId, systemId) without proper escaping, which can lead to premature termination of the DOCTYPE declaration and injection of arbitrary markup.
- CVE-2026-41672High
The vulnerability in the xmldom library allows an attacker to inject arbitrary XML nodes into serialized output via controlled comment content. Lack of validation of comment-breaking sequences enables premature comment termination and insertion of malicious XML code.
Original NVD description (English source)
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9, xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator ]]> to be inserted into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without rejecting or safely splitting the terminator. As a result, data intended to remain text-only became active XML markup in the serialized output, enabling XML structure injection and downstream business-logic manipulation. This issue has been patched in xmldom version 0.6.0 and @xmldom/xmldom versions 0.8.12 and 0.9.9.