Is CVE-2026-41674 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41674 being exploited in the wild.

How severe is CVE-2026-41674?

High severity, with a CVSS score of 7.5, published 7 May 2026.

Which products and versions are affected?

@xmldom/xmldom (npm) SEMVER:introduced=0,fixed=0.8.13; xmldom (npm) SEMVER:introduced=0,last_affected=0.6.0.

Is there a fix for CVE-2026-41674?

Yes. @xmldom/xmldom (npm): upgrade to 0.8.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41674 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-41674?

Check whether you run @xmldom/xmldom (npm) or xmldom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41674: xmldom XML injection in DocumentType serialization

CVE-2026-41674 · Severity: high · CVSS 7.5 · Published 2026-05-07

xmldom is a JavaScript library used to process and create XML documents. A security flaw allows attackers to inject malicious content into XML files if they can control certain document properties. This could lead to the creation of malformed or malicious XML files that might bypass security checks or cause issues in downstream systems that process the generated data.

Technologies: @xmldom/xmldom (npm), xmldom (npm). Vendors: npm.

Quick answers

Is CVE-2026-41674 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41674 being exploited in the wild.
How severe is CVE-2026-41674?: High severity, with a CVSS score of 7.5, published 7 May 2026.
Which products and versions are affected?: @xmldom/xmldom (npm) SEMVER:introduced=0,fixed=0.8.13; xmldom (npm) SEMVER:introduced=0,last_affected=0.6.0.
Is there a fix for CVE-2026-41674?: Yes. @xmldom/xmldom (npm): upgrade to 0.8.13 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41674 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-41674?: Check whether you run @xmldom/xmldom (npm) or xmldom (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@xmldom/xmldom (npm): upgrade to 0.8.13 or later
```
npm install @xmldom/xmldom@0.8.13
```

Technical details

The vulnerability exists in the XMLSerializer.serializeToString function of the xmldom library. The component fails to validate or escape DocumentType node fields, specifically internalSubset, publicId, and systemId, during serialization. If an attacker can programmatically set these fields to malicious strings, they can terminate the DOCTYPE declaration prematurely and inject arbitrary XML markup. This is classified as XML Injection (CWE-91). The issue is addressed in versions 0.9.10 and 0.8.13 by introducing a 'requireWellFormed' option that validates these fields against XML 1.0 productions.

Affected products

xmldom xmldom <= 0.6.0
@xmldom/xmldom xmldom >= 0.9.0, < 0.9.10
@xmldom/xmldom xmldom < 0.8.13

Identifiers

CVE-2026-41674
GHSA-f6ww-3ggp-fr8h

Timeline

2026-04-18: patched: Fixes released in versions 0.9.10 and 0.8.13
2026-05-07: disclosed: CVE-2026-41674 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.