xmldom prior 0.8.13/0.9.10 DOMParser/XMLSerializer xml injection

Summaryinfo

A vulnerability was found in xmldom and classified as critical. Affected is an unknown function of the component DOMParser/XMLSerializer. Such manipulation leads to xml injection. This vulnerability is listed as CVE-2026-41675. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in xmldom and classified as critical. Affected by this issue is an unknown code of the component DOMParser/XMLSerializer. The manipulation with an unknown input leads to a xml injection vulnerability. Using CWE to declare the problem leads to CWE-91. The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system. Impacted is confidentiality, integrity, and availability. CVE summarizes:

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled processing instruction data to be serialized into XML without validating or neutralizing the PI-closing sequence ?>. As a result, an attacker can terminate the processing instruction early and inject arbitrary XML nodes into the serialized output. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-41675 since 04/22/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1505 by the MITRE ATT&CK project.

The vulnerability scanner Nessus provides a plugin with the ID 313065 (Linux Distros Unpatched Vulnerability : CVE-2026-41675), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.8.13 or 0.9.10 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 7207a4b0e0bcc228868075ed991665ef9f73b1c2 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (313065). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• xmldom

License

• open-source

Website

• Product: https://github.com/xmldom/xmldom/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion