CVE-2026-41674 Details

A vulnerability in the xmldom package, specifically in versions prior to 0.9.10 and 0.8.13, allows for XML injection through unvalidated serialization of DocumentType node fields. The issue arises because the XMLSerializer.serializeToString method emits these fields verbatim, without any escaping or validation. When fields are populated with attacker-controlled strings, the serialization can be manipulated to terminate the DOCTYPE declaration early, causing arbitrary markup to appear outside of it. This vulnerability is present in the @xmldom/xmldom package in versions prior to 0.8.13 and in the 0.9.0 to 0.9.10 range.

Users can update to xmldom version 0.9.10 or 0.8.13, where this vulnerability has been patched. After updating, it's important to review all serialization calls and add the { requireWellFormed: true } option to ensure proper validation of DocumentType fields before serialization.