PT-2026-34618 · Root+6 · @Rootio/Xmldom Xmldom+10
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
@xmldom/xmldom versions prior to 0.8.13
@xmldom/xmldom versions prior to 0.9.10
xmldom versions 0.6.0 and earlier
Description
The software allows attacker-controlled processing instruction (PI) data to be serialized into XML without validating or neutralizing the PI-closing sequence
?>. This occurs because the createProcessingInstruction() function stores the data variable directly without validation, and the serializer subsequently concatenates this data verbatim. An attacker can use the ?> sequence to terminate the processing instruction prematurely and inject arbitrary XML nodes into the serialized output, potentially altering the structure and meaning of the generated XML documents.Recommendations
For @xmldom/xmldom versions prior to 0.8.13 and 0.9.10, update to version 0.8.13 or 0.9.10 and explicitly pass the
{ requireWellFormed: true } option to the serializeToString() function to enable validation that prevents the injection of ?> sequences.
For xmldom versions 0.6.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
@Rootio/Xmldom Xmldom
@Xmldom/Xmldom
Red Hat Build Of Podman Desktop
Red Hat Developer Hub 1.9
Red Hat Enterprise Linux 8
Red Hat Fuse 7
Red Hat Openshift
Red Hat Openshift Container Platform 4
Self-Service Automation Portal 2
Node-Xmldom
Xmldom