Junglewise Threat Intelligence

CVE-2026-41672: xmldom XML injection in XMLSerializer comment serialization

CVE-2026-41672 · Severity: high · CVSS 7.5 · Published 2026-05-07

Technologies: Xmldom @Xmldom/Xmldom, Xmldom.

Executive brief

The xmldom library, a tool used by developers to process and create XML files in JavaScript applications, contains a vulnerability that allows for 'XML injection.' An attacker can provide specially crafted text that tricks the library into ending a comment early and inserting unauthorized data or commands into the resulting XML document. This could lead to data corruption, unauthorized access, or security bypasses in applications that rely on this library to handle user-provided data.

Technical details

An XML injection vulnerability exists in the XMLSerializer component of xmldom. The root cause is the failure to validate or escape comment-breaking sequences (such as '-->') within attacker-controlled comment content during serialization. By including these sequences, an attacker can prematurely terminate an XML comment and inject arbitrary XML elements into the serialized output. This can be exploited remotely if an application serializes user-provided input into XML comments. The issue is addressed in versions 0.9.10 and 0.8.13 by introducing a 'requireWellFormed' option that throws an error when such sequences are detected.

Affected products

  • xmldom xmldom <= 0.6.0
  • xmldom @xmldom/xmldom >= 0.9.0, < 0.9.10
  • xmldom @xmldom/xmldom < 0.8.13

Timeline

  • 2026-04-06: other: Initial pull request with fix and disclosure submitted by researcher
  • 2026-04-18: patched: Official patches released in versions 0.8.13 and 0.9.10
  • 2026-05-07: advisory: CVE-2026-41672 published

References