CVE-2026-34601 Details

A vulnerability exists in xmldom versions through 0.6.0 and in @xmldom/xmldom versions prior to 0.8.12 and 0.9.9. This vulnerability allows attacker-controlled strings containing the CDATA terminator ']]>' to be inserted into a CDATASection node. The issue arises because the XMLSerializer serializes CDATA content verbatim, without properly handling or rejecting the terminator. As a result, data meant to be text-only is interpreted as active XML markup in the serialized output. This flaw enables XML structure injection and manipulation of downstream business logic.

Users can update to xmldom version 0.6.0 or @xmldom/xmldom versions 0.8.12 or 0.9.9 to address this vulnerability. After updating, any attempt to use createCDATASection with data containing ']]>' will result in an InvalidCharacterError, as required by the WHATWG DOM specification. Additionally, the XMLSerializer will automatically split CDATA section data containing ']]>' into separate sections, preventing injection through mutation methods.