Junglewise Threat Intelligence

CVE-2026-41674: xmldom XML injection in DocumentType serialization

CVE-2026-41674 · Severity: high · CVSS 7.5 · Published 2026-05-07

Technologies: @Xmldom/Xmldom Xmldom.

Executive brief

xmldom is a JavaScript library used to process and create XML documents. A security flaw allows attackers to inject malicious content into XML files if they can control certain document properties. This could lead to the creation of malformed or malicious XML files that might bypass security checks or cause issues in downstream systems that process the generated data.

Technical details

The vulnerability exists in the XMLSerializer.serializeToString function of the xmldom library. The component fails to validate or escape DocumentType node fields, specifically internalSubset, publicId, and systemId, during serialization. If an attacker can programmatically set these fields to malicious strings, they can terminate the DOCTYPE declaration prematurely and inject arbitrary XML markup. This is classified as XML Injection (CWE-91). The issue is addressed in versions 0.9.10 and 0.8.13 by introducing a 'requireWellFormed' option that validates these fields against XML 1.0 productions.

Affected products

  • xmldom xmldom <= 0.6.0
  • @xmldom/xmldom xmldom >= 0.9.0, < 0.9.10
  • @xmldom/xmldom xmldom < 0.8.13

Timeline

  • 2026-04-18: patched: Fixes released in versions 0.9.10 and 0.8.13
  • 2026-05-07: disclosed: CVE-2026-41674 published

References