CVE-2026-34601XML Injection (aka Blind XPath Injection) in Node-xmldom

Severity
7.5HIGHNVD
EPSS
0.1%
top 83.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedApr 2
Latest updateApr 3

Description

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9, xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator ]]> to be inserted into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without rejecting or safely splitting the terminator. As a result, data intended to remain text-only be

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

debiandebian/node-xmldom< node-xmldom 0.9.9-1 (forky)
npmxmldom/xmldom0.9.00.9.9+2
CVEListV5xmldom/xmldom@xmldom/xmldom < 0.8.12, @xmldom/xmldom >= 0.9.0, < 0.9.9, xmldom <= 0.6.0+2

🔴Vulnerability Details

4
OSV
CVE-2026-34601: (xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core)2026-04-03
OSV
CVE-2026-34601: xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module2026-04-02
GHSA
xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion2026-04-01
OSV
xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion2026-04-01

📋Vendor Advisories

3
Microsoft
xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion2026-04-02
Red Hat
xmldom: xmldom: XML structure injection via CDATA terminator2026-04-02
Debian
CVE-2026-34601: node-xmldom - xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser...2026

🕵️Threat Intelligence

1
Wiz
CVE-2026-34601 Impact, Exploitability, and Mitigation Steps | Wiz
CVE-2026-34601 — Debian Node-xmldom vulnerability | cvebase