CVE-2026-41672
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
The vulnerability in the xmldom library allows an attacker to inject arbitrary XML nodes into serialized output via controlled comment content. Lack of validation of comment-breaking sequences enables premature comment termination and insertion of malicious XML code.
Risk Assessment
The organization is exposed to XML Injection attacks, which can lead to data integrity compromise, unauthorized processing, or information leakage in systems using this library.
Recommendation
Immediately update the @xmldom/xmldom library to version 0.9.10 or 0.8.13, and for the older xmldom version to 0.6.0 or later if a patch is available.
Other vulnerabilities in xmldom
See all- CVE-2026-41674High
Vulnerability in @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and earlier. The package serializes DocumentType fields (internalSubset, publicId, systemId) without proper escaping, which can lead to premature termination of the DOCTYPE declaration and injection of arbitrary markup.
- CVE-2026-34601High
In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to 0.8.12 and 0.9.9, an attacker can insert a string containing the CDATA terminator ]]> into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without rejecting or safely splitting the terminator, enabling XML structure injection and downstream business-logic manipulation. The issue is patched in xmldom 0.6.0 and @xmldom/xmldom 0.8.12 and 0.9.9.
Original NVD description (English source)
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled comment content to be serialized into XML without validating or neutralizing comment-breaking sequences. As a result, an attacker can terminate the comment early and inject arbitrary XML nodes into the serialized output. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.