Vulnerability · Published May 7, 2026 · Assigned by GitHub_M

CVE-2026-41674xmldom: XML injection through unvalidated DocumentType serialization

High 7.5

In plain English

A high-severity security flaw in xmldom from xmldom. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 52.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package serializes DocumentType node fields (internalSubset, publicId, systemId) verbatim without any escaping or validation. When these fields are set programmatically to attacker-controlled strings, XMLSerializer.serializeToString can produce output where the DOCTYPE declaration is terminated early and arbitrary markup appears outside it. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	node-xmldom	no fix listed	DEBIAN-CVE-2026-41674
Debian:13	node-xmldom	no fix listed	DEBIAN-CVE-2026-41674
Debian:14	node-xmldom	0.9.10-1	DEBIAN-CVE-2026-41674
Ubuntu:22.04:LTS	node-xmldom	no fix listed	UBUNTU-CVE-2026-41674
Ubuntu:24.04:LTS	node-xmldom	no fix listed	UBUNTU-CVE-2026-41674
Ubuntu:25.10	node-xmldom	no fix listed	UBUNTU-CVE-2026-41674
Ubuntu:26.04:LTS	node-xmldom	no fix listed	UBUNTU-CVE-2026-41674
Ubuntu:26.10	node-xmldom	no fix listed	UBUNTU-CVE-2026-41674
npm	@xmldom/xmldom	0.9.10	GHSA-f6ww-3ggp-fr8h
npm	@xmldom/xmldom	0.8.13	GHSA-f6ww-3ggp-fr8h
npm	xmldom	no fix listed	GHSA-f6ww-3ggp-fr8h

Affected products (as reported)

Vendor	Product	Versions
xmldom	xmldom	xmldom <= 0.6.0@xmldom/xmldom >= 0.9.0, < 0.9.10@xmldom/xmldom < 0.8.13

Weakness: CWE-91 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

https://github.com/xmldom/xmldom/security/advisories/GHSA-f6ww-3ggp-fr8h x_refsource_CONFIRM
https://github.com/xmldom/xmldom/commit/372008f9ae0e20fd69f761c7b79e202598267314 x_refsource_MISC
https://github.com/xmldom/xmldom/releases/tag/0.8.13 x_refsource_MISC
https://github.com/xmldom/xmldom/releases/tag/0.9.10 x_refsource_MISC
https://access.redhat.com/security/cve/CVE-2026-41674 vdb-entry, x_refsource_REDHAT
RHBZ#2467620 issue-tracking, x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41674.json x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:21338 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26234 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21703 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:20034 vendor-advisory, x_refsource_REDHAT