PT-2026-29497 · Xmldom+1 · Xmldom+1
Thesmartshadow
·
Published
2026-04-01
·
Updated
2026-06-04
·
CVE-2026-34601
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
xmldom versions 0.6.0 and prior, and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9
Description
The
xmldom library contains a flaw where attacker-controlled strings including the CDATA terminator ]]> can be inserted into a CDATASection node. During serialization, the XMLSerializer emits the CDATA content without rejecting or safely splitting the terminator. This allows data intended as text to become active XML markup in the serialized output, enabling XML structure injection and potential manipulation of downstream business logic. The issue affects Document.createCDATASection(data), CharacterData.appendData(), CharacterData.replaceData(), CharacterData.insertData(), and direct assignment to .data or .textContent. Parsing XML containing a CDATA section is not affected. Exploitation can lead to integrity violations of generated XML documents and potential business-logic injection in downstream consumers.Recommendations
Update to xmldom version 0.6.0 or later. Update @xmldom/xmldom to version 0.8.12 or 0.9.9 or later.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
@Xmldom/Xmldom
Xmldom