CVE-2026-41674
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
Vulnerability in @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and earlier. The package serializes DocumentType fields (internalSubset, publicId, systemId) without proper escaping, which can lead to premature termination of the DOCTYPE declaration and injection of arbitrary markup.
Risk Assessment
An attacker can inject arbitrary XML/HTML markup, potentially leading to XML Injection attacks or other output manipulation.
Recommendation
Update @xmldom/xmldom to version 0.9.10 or 0.8.13, and xmldom to a version later than 0.6.0.
Other vulnerabilities in xmldom
See all- CVE-2026-41672High
The vulnerability in the xmldom library allows an attacker to inject arbitrary XML nodes into serialized output via controlled comment content. Lack of validation of comment-breaking sequences enables premature comment termination and insertion of malicious XML code.
- CVE-2026-34601High
In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to 0.8.12 and 0.9.9, an attacker can insert a string containing the CDATA terminator ]]> into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without rejecting or safely splitting the terminator, enabling XML structure injection and downstream business-logic manipulation. The issue is patched in xmldom 0.6.0 and @xmldom/xmldom 0.8.12 and 0.9.9.
Original NVD description (English source)
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package serializes DocumentType node fields (internalSubset, publicId, systemId) verbatim without any escaping or validation. When these fields are set programmatically to attacker-controlled strings, XMLSerializer.serializeToString can produce output where the DOCTYPE declaration is terminated early and arbitrary markup appears outside it. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.