PT-2026-34618 · Root+4 · @Rootio/Xmldom Xmldom+3

Tharvid + 1 · Published 2026-04-22 · Updated 2026-05-07 · CVE-2026-41675

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions @xmldom/xmldom versions prior to 0.8.13 @xmldom/xmldom versions prior to 0.9.10 xmldom versions 0.6.0 and earlier

Description The software allows attacker-controlled processing instruction (PI) data to be serialized into XML without validating or neutralizing the PI-closing sequence ?>. This occurs because the createProcessingInstruction() function stores the data variable directly without validation, and the serializer subsequently concatenates this data verbatim. An attacker can use the ?> sequence to terminate the processing instruction prematurely and inject arbitrary XML nodes into the serialized output, potentially altering the structure and meaning of the generated XML documents.

Recommendations For @xmldom/xmldom versions prior to 0.8.13 and 0.9.10, update to version 0.8.13 or 0.9.10 and explicitly pass the { requireWellFormed: true } option to the serializeToString() function to enable validation that prevents the injection of ?> sequences. For xmldom versions 0.6.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-91

Related Identifiers

CVE-2026-41675

GHSA-X6WF-F3PX-WCQX

Affected Products

@Rootio/Xmldom Xmldom

@Xmldom/Xmldom

Node-Xmldom

Xmldom

References · 15

• 🔥 https://github.com/xmldom/xmldom/security/advisories/GHSA-x6wf-f3px-wcqx · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41675 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-41675 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41675 · Security Note
• https://osv.dev/vulnerability/GHSA-x6wf-f3px-wcqx · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-41675 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41675 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-41675 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-41675 · Vendor Advisory
• https://github.com/xmldom/xmldom/commit/7207a4b0e0bcc228868075ed991665ef9f73b1c2 · Note
• https://github.com/xmldom/xmldom/releases/tag/0.9.10 · Note
• https://github.com/xmldom/xmldom/releases/tag/0.8.13 · Note
• https://github.com/xmldom/xmldom · Note
• https://twitter.com/CVEarity/status/2052426555201372341 · Twitter Post
• https://t.me/CVEtracker/52937 · Telegram Post