PT-2026-34615 · Root+4 · @Rootio/Xmldom Xmldom+3

Jvr2022 + 1 · Published 2026-04-22 · Updated 2026-05-07 · CVE-2026-41672

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions @xmldom/xmldom versions prior to 0.8.13 @xmldom/xmldom versions prior to 0.9.10 xmldom versions prior to 0.6.0

Description The software allows attacker-controlled comment content to be serialized into XML without validating or neutralizing comment-breaking sequences. This occurs during the DOM construction and serialization flow for comment nodes when the createComment() function is called; the supplied string is stored as-is and later concatenated with XML comment delimiters during serialization. Because XML comments are syntax-sensitive, an attacker can provide input containing a sequence that closes the comment, allowing them to terminate the comment early and inject arbitrary XML nodes into the serialized output. This can enable an attacker to alter the meaning and structure of generated XML documents, affecting workflows that store, forward, sign, or parse the resulting XML, such as configuration or policy documents.

Recommendations For @xmldom/xmldom versions prior to 0.8.13 and 0.9.10, update to version 0.8.13 or 0.9.10 and explicitly pass the { requireWellFormed: true } option to the serializeToString() function to enable protection. For xmldom versions prior to 0.6.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-91

Related Identifiers

CVE-2026-41672

GHSA-J759-J44W-7FR8

Affected Products

@Rootio/Xmldom Xmldom

@Xmldom/Xmldom

Node-Xmldom

Xmldom

References · 17

• 🔥 https://github.com/xmldom/xmldom/security/advisories/GHSA-j759-j44w-7fr8 · Exploit
• https://osv.dev/vulnerability/GHSA-j759-j44w-7fr8 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41672 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-41672 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41672 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41672 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-41672 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-41672 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-41672 · Vendor Advisory
• https://github.com/xmldom/xmldom/commit/b397540889086da868c30c366ad5c220d1a750c7 · Note
• https://github.com/xmldom/xmldom/commit/fda7cc313de30243fea35cada64e0bb12099c2a1 · Note
• https://github.com/xmldom/xmldom/releases/tag/0.9.10 · Note
• https://github.com/xmldom/xmldom/pull/987 · Note
• https://github.com/xmldom/xmldom/releases/tag/0.8.13 · Note
• https://github.com/xmldom/xmldom · Note