PT-2026-34617 · Root+6 · @Rootio/Xmldom Xmldom+12
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
@xmldom/xmldom versions prior to 0.8.13
@xmldom/xmldom versions prior to 0.9.10
xmldom versions prior to 0.6.0
Description
The package serializes
DocumentType node fields (internalSubset, publicId, and systemId) verbatim without escaping or validation. When these fields are set programmatically via the createDocumentType() function or direct property writes using attacker-controlled strings, the XMLSerializer.serializeToString method can produce output where the DOCTYPE declaration is terminated prematurely, allowing arbitrary markup to appear outside of it. Specifically, injecting ]> into internalSubset or > into systemId can close the DOCTYPE early, while manipulating publicId can break the quoting context to inject fake SYSTEM entries. This can lead to XXE-class attacks if downstream XML parsers re-parse the output with entity expansion enabled.Recommendations
Update @xmldom/xmldom to versions 0.8.13 or 0.9.10.
Update xmldom to a version later than 0.6.0.
As a mitigation, pass the
{ requireWellFormed: true } option to the serializeToString() method to enable validation of DocumentType fields and throw an InvalidStateError upon detecting injection sequences.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
@Rootio/Xmldom Xmldom
@Xmldom/Xmldom
Red Hat Build Of Podman Desktop
Red Hat Developer Hub 1.8
Red Hat Developer Hub 1.9
Red Hat Fuse 7
Red Hat Openshift
Red Hat Openshift Container Platform 4.2
Red Hat Openshift Container Platform 4.20
Red Hat Openshift Container Platform 4.21
Self-Service Automation Portal 2
Node-Xmldom
Xmldom