CVE-2026-34601
published 2026-04-02CVE-2026-34601: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In xmldom versions 0.6.0 and prior and…
PriorityP348high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
0.47%
37.7th percentile
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9, xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator ]]> to be inserted into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without rejecting or safely splitting the terminator. As a result, data intended to remain text-only became active XML markup in the serialized output, enabling XML structure injection and downstream business-logic manipulation. This issue has been patched in xmldom version 0.6.0 and @xmldom/xmldom versions 0.8.12 and 0.9.9.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | node-xmldom | < node-xmldom 0.9.9-1 (forky) | node-xmldom 0.9.9-1 (forky) |
| msrc | azl3_python-tensorboard_2.16.2-6_on_azure_linux_3.0 | — | — |
| msrc | cbl2_python-tensorboard_2.11.0-3_on_cbl_mariner_2.0 | — | — |
| xmldom | xmldom | — | — |
| xmldom | xmldom | — | — |
| xmldom | xmldom | — | — |
| xmldom | xmldom | >= 0 < 0.8.12 | 0.8.12 |
| xmldom | xmldom | >= 0 < 0.8.13 | 0.8.13 |
| xmldom | xmldom | 0 – 0.6.0 | — |
| xmldom | xmldom | >= 0.9.0 < 0.9.9 | 0.9.9 |
| xmldom | xmldom | >= 0.9.0 < 0.9.10 | 0.9.10 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
ghsa7.5HIGH
osv7.5HIGH
vendor_debian7.5HIGH
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
xmldom up to 0.8.11/0.9.8 xml injection (GHSA-wh4c-j3r5-mjhp / Nessus ID 304904)
vuldb·2026-06-20·CVSS 7.5
CVE-2026-34601 [HIGH] xmldom up to 0.8.11/0.9.8 xml injection (GHSA-wh4c-j3r5-mjhp / Nessus ID 304904)
A vulnerability marked as critical has been reported in xmldom up to 0.8.11/0.9.8. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in xml injection.
This vulnerability is identified as CVE-2026-34601. The attack can be initiated remotely. There is not any exploit available.
It is suggested to upgrade the affected component.
GHSA
xmldom has XML node injection through unvalidated processing instruction serialization
ghsa·2026-04-22·CVSS 7.5
CVE-2026-41675 [HIGH] CWE-91 xmldom has XML node injection through unvalidated processing instruction serialization
xmldom has XML node injection through unvalidated processing instruction serialization
## Summary
The package allows attacker-controlled processing instruction data to be serialized into XML without validating or neutralizing the PI-closing sequence `?>`. As a result, an attacker can terminate the processing instruction early and inject arbitrary XML nodes into the serialized output.
---
## Details
The issue is in the DOM construction and serialization flow for processing instruction nodes.
When `createProcessingInstruction(target, data)` is called, the supplied `data` string is stored directly on the node without validation. Later, when the document is serialized, the serializer writes PI nodes by concatenating `` directly.
That behavior is unsafe because processing instructions ar
OSV
CVE-2026-34601: (xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core)
osv·2026-04-03·CVSS 7.5
CVE-2026-34601 [HIGH] CVE-2026-34601: (xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core)
(xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) ...)
OSV
CVE-2026-34601: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module
osv·2026-04-02·CVSS 7.5
CVE-2026-34601 [HIGH] CVE-2026-34601: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9, xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator ]]> to be inserted into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without rejecting or safely splitting the terminator. As a result, data intended to remain text-only became active XML markup in the serialized output, enabling XML structure injection and downstream business-logic manipulation. This issue has been patched in xmldom version 0.6.0 and @xmldom/xmldom versions 0.8.12 and 0.9.9.
GHSA
xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion
ghsa·2026-04-01
CVE-2026-34601 [HIGH] CWE-91 xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion
xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion
## Summary
`@xmldom/xmldom` allows attacker-controlled strings containing the CDATA terminator `]]>` to be inserted into a `CDATASection` node. During serialization, `XMLSerializer` emitted the CDATA content verbatim without rejecting or safely splitting the terminator. As a result, data intended to remain text-only became **active XML markup** in the serialized output, enabling XML structure
injection and downstream business-logic manipulation.
The sequence `]]>` is not allowed inside CDATA content and must be rejected or safely handled during serialization. ([MDN Web Docs](https://developer.mozilla.org/))
### Attack surface
`Document.createCDATASection(data)` is the most direct entry poi
OSV
xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion
osv·2026-04-01
CVE-2026-34601 [HIGH] xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion
xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion
## Summary
`@xmldom/xmldom` allows attacker-controlled strings containing the CDATA terminator `]]>` to be inserted into a `CDATASection` node. During serialization, `XMLSerializer` emitted the CDATA content verbatim without rejecting or safely splitting the terminator. As a result, data intended to remain text-only became **active XML markup** in the serialized output, enabling XML structure
injection and downstream business-logic manipulation.
The sequence `]]>` is not allowed inside CDATA content and must be rejected or safely handled during serialization. ([MDN Web Docs](https://developer.mozilla.org/))
### Attack surface
`Document.createCDATASection(data)` is the most direct entry poi
Microsoft
xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion
vendor_msrc·2026-04-02·CVSS 7.5
CVE-2026-34601 [HIGH] CWE-91 xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion
xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Red Hat
xmldom: xmldom: XML structure injection via CDATA terminator
vendor_redhat·2026-04-02·CVSS 7.5
CVE-2026-34601 [HIGH] CWE-91 xmldom: xmldom: XML structure injection via CDATA terminator
xmldom: xmldom: XML structure injection via CDATA terminator
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9, xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator ]]> to be inserted into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without rejecting or safely splitting the terminator. As a result, data intended to remain text-only became active XML markup in the serialized output, enabling XML structure injection and downstream business-logic manipulation. This issue has been patched in xmldom version 0.6.0 and @xmldom/xmldom versions 0.8.12 and 0.9.9.
A flaw was fo
Debian
CVE-2026-34601: node-xmldom - xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser...
vendor_debian·2026·CVSS 7.5
CVE-2026-34601 [HIGH] CVE-2026-34601: node-xmldom - xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser...
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9, xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator ]]> to be inserted into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without rejecting or safely splitting the terminator. As a result, data intended to remain text-only became active XML markup in the serialized output, enabling XML structure injection and downstream business-logic manipulation. This issue has been patched in xmldom version 0.6.0 and @xmldom/xmldom versions 0.8.12 and 0.9.9.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 0.9.9-1
No detection rules found.
No public exploits indexed.
https://github.com/xmldom/xmldom/commit/2b852e836ab86dbbd6cbaf0537f584dd0b5ac184https://github.com/xmldom/xmldom/releases/tag/0.8.12https://github.com/xmldom/xmldom/releases/tag/0.9.9https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhphttps://access.redhat.com/security/cve/CVE-2026-34601https://bugzilla.redhat.com/show_bug.cgi?id=2454595https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhphttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34601.json
2026-04-02
Published