CVE-2026-41675 Details
Description
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled processing instruction data to be serialized into XML without validating or neutralizing the PI-closing sequence ?>. As a result, an attacker can terminate the processing instruction early and inject arbitrary XML nodes into the serialized output. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.
A vulnerability in the xmldom package, specifically in versions prior to 0.9.10 and 0.8.13, as well as in xmldom version 0.6.0 and prior, allows for XML injection through unvalidated processing instruction (PI) data. The issue arises because the serializer does not properly validate or neutralize PI-closing sequences, enabling attackers to terminate the PI early and inject arbitrary XML nodes. This vulnerability has been addressed in @xmldom/xmldom versions 0.9.10 and 0.8.13.
Users can update to @xmldom/xmldom versions 0.9.10 or 0.8.13 to address this vulnerability. After updating, it is important to pass the option '{ requireWellFormed: true }' to the 'XMLSerializer.serializeToString()' method to ensure proper validation of processing instruction data.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 7, 2026CISA-ADP
Assessed May 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2026:26234 | redhat-SADP | |
| https://access.redhat.com/errata/RHSA-2026:60520 | redhat-SADP | |
| https://access.redhat.com/security/cve/CVE-2026-41675 | redhat-SADP | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2467629 | redhat-SADP | |
| https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41675.json | redhat-SADP | |
| https://github.com/xmldom/xmldom/security/advisories/GHSA-x6wf-f3px-wcqx | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/xmldom/xmldom/commit/7207a4b0e0bcc228868075ed991665ef9f73b1c2 | [email protected] | Source CodeVendor |
| https://github.com/xmldom/xmldom/releases/tag/0.8.13 | [email protected] | Release NotesVendor |
| https://github.com/xmldom/xmldom/releases/tag/0.9.10 | [email protected] | Release NotesVendor |
| https://github.com/xmldom/xmldom/security/advisories/GHSA-x6wf-f3px-wcqx | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-91 | XML Injection (aka Blind XPath Injection) | redhat-SADP |
| CWE-91 | XML Injection (aka Blind XPath Injection) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| @xmldom/xmldom | < 0.8.13 (semver) >= 0.9.0, < 0.9.10 (semver) |
CPE
Remediation
| |
| xmldom | All versions |
CPE
Remediation
| |
Change History
11 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 28, 2026 | CVE Modified | [email protected] |
| Aug 28, 2026 | CVE Modified | CISA-ADP |
| Aug 28, 2026 | CVE Modified | redhat-SADP |
| Aug 19, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jul 6, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | New CVE Received | [email protected] |