Is CVE-2026-41672 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41672 being exploited in the wild.

How severe is CVE-2026-41672?

High severity, with a CVSS score of 7.5, published 7 May 2026.

Which products and versions are affected?

@xmldom/xmldom (npm) SEMVER:introduced=0,fixed=0.8.13; xmldom (npm) SEMVER:introduced=0,last_affected=0.6.0.

Is there a fix for CVE-2026-41672?

Yes. @xmldom/xmldom (npm): upgrade to 0.8.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41672 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-41672?

Check whether you run @xmldom/xmldom (npm) or xmldom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41672: xmldom XML injection in XMLSerializer comment serialization

CVE-2026-41672 · Severity: high · CVSS 7.5 · Published 2026-05-07

The xmldom library, a tool used by developers to process and create XML files in JavaScript applications, contains a vulnerability that allows for 'XML injection.' An attacker can provide specially crafted text that tricks the library into ending a comment early and inserting unauthorized data or commands into the resulting XML document. This could lead to data corruption, unauthorized access, or security bypasses in applications that rely on this library to handle user-provided data.

Technologies: @xmldom/xmldom (npm), xmldom (npm). Vendors: npm.

Quick answers

Is CVE-2026-41672 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41672 being exploited in the wild.
How severe is CVE-2026-41672?: High severity, with a CVSS score of 7.5, published 7 May 2026.
Which products and versions are affected?: @xmldom/xmldom (npm) SEMVER:introduced=0,fixed=0.8.13; xmldom (npm) SEMVER:introduced=0,last_affected=0.6.0.
Is there a fix for CVE-2026-41672?: Yes. @xmldom/xmldom (npm): upgrade to 0.8.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41672 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-41672?: Check whether you run @xmldom/xmldom (npm) or xmldom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@xmldom/xmldom (npm): upgrade to 0.8.13 or later
```
npm install @xmldom/xmldom@0.8.13
```

Technical details

An XML injection vulnerability exists in the XMLSerializer component of xmldom. The root cause is the failure to validate or escape comment-breaking sequences (such as '-->') within attacker-controlled comment content during serialization. By including these sequences, an attacker can prematurely terminate an XML comment and inject arbitrary XML elements into the serialized output. This can be exploited remotely if an application serializes user-provided input into XML comments. The issue is addressed in versions 0.9.10 and 0.8.13 by introducing a 'requireWellFormed' option that throws an error when such sequences are detected.

Affected products

xmldom xmldom <= 0.6.0
xmldom @xmldom/xmldom >= 0.9.0, < 0.9.10
xmldom @xmldom/xmldom < 0.8.13

Identifiers

CVE-2026-41672
GHSA-j759-j44w-7fr8

Timeline

2026-04-06: other: Initial pull request with fix and disclosure submitted by researcher
2026-04-18: patched: Official patches released in versions 0.8.13 and 0.9.10
2026-05-07: advisory: CVE-2026-41672 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.