CVE-2026-34601

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMParser.parseFromString() can silently accept an end tag such as </a\njunk>, close the element, and discard the trailing content. On 0.9.x, the lib/sax.js end-tag validator inherits the multiline flag from reg(), allowing the first line to satisfy the anchored XML ETag production; older lines have no equivalent residue validation. This parser differential can bypass a parse-before-trust well-formedness gate, although it does not inject the discarded content; onError on 0.9.x and errorHandler on 0.8.x are the relevant reporting interfaces. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createEntityReference(name) accepts an invalid name and the ENTITY_REFERENCE_NODE serializer emits the resulting nodeName directly in &name; form. Directly serializing the node or fragment with XMLSerializer.serializeToString() and requireWellFormed: true can therefore break the entity-reference boundary and produce attacker-controlled XML markup when reparsed. The parser does not ordinarily create these nodes, and element-child insertion is rejected, so exploitation requires an application to create and directly serialize an EntityReference. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.

In xmldom versions 0.9.0 through 0.9.11, the QName_exact validator uses the multiline flag, accepting malformed XML names containing line terminators. This can lead to markup injection during serialization.

In xmldom before versions 0.8.15 and 0.9.12, and in version 0.6.0 and earlier, the DocumentType.name is not validated and can contain > or whitespace, allowing to break the DOCTYPE declaration and inject additional markup.

In xmldom before versions 0.8.14 and 0.9.11, and in version 0.6.0 and earlier, the element name in createElement is not validated, and XMLSerializer emits it verbatim. This can lead to injection of attributes, elements, or processing instructions into serialized XML/HTML.

In xmldom from version 0.9.0-beta.9 to 0.9.11, the expression used for parsing processing instructions can cause quadratic backtracking on long whitespace tails when the closing ?> is missing. This can stall the Node.js event loop.

In xmldom before versions 0.8.14 and 0.9.11, and in version 0.6.0 and earlier, Element.setAttribute() does not validate the attribute name, and XMLSerializer emits it verbatim. This can lead to injection of additional attributes, including event handlers.

Vulnerability in @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and earlier. The package serializes DocumentType fields (internalSubset, publicId, systemId) without proper escaping, which can lead to premature termination of the DOCTYPE declaration and injection of arbitrary markup.

The vulnerability in the xmldom library allows an attacker to inject arbitrary XML nodes into serialized output via controlled comment content. Lack of validation of comment-breaking sequences enables premature comment termination and insertion of malicious XML code.