CVE-2026-41672 Details

A vulnerability in the xmldom package, specifically in versions prior to 0.9.10 and 0.8.13, as well as in xmldom version 0.6.0 and prior, allows for XML injection through unvalidated comment data. The issue arises because the serializer does not properly validate or neutralize comment-breaking sequences in attacker-controlled content. This oversight enables the injection of arbitrary XML nodes by terminating the comment early and manipulating the serialized output. The vulnerability has been addressed in @xmldom/xmldom versions 0.9.10 and 0.8.13.

Users can update to @xmldom/xmldom versions 0.9.10 or 0.8.13 to address this vulnerability. After updating, it's important to review all serialization calls and pass the 'requireWellFormed: true' option to ensure comment data is properly validated before serialization.