Description
The package serializes DocumentType node fields (internalSubset, publicId, systemId) verbatim without any escaping or validation. When these fields are set programmatically to attacker-controlled strings, XMLSerializer.serializeToString can produce output where the DOCTYPE declaration is terminated early and arbitrary markup appears outside it.
Recommendation
Update the @xmldom/xmldom package to the latest compatible version. Followings are version details:
Affected version(s): **>= 0.9.0, < 0.9.10 < 0.8.13** Patched version(s): **0.9.10 0.8.13**
References
Could your website be exposed too?
SmartScanner can check your website for xmldom has XML injection through unvalidated DocumentType serialization and gives you actionable findings to investigate.
Start a free scanRelated Issues
- xmldom has XML injection through unvalidated DocumentType serialization - xmldom - CVE-2026-41674
- xmldom has XML node injection through unvalidated comment serialization - CVE-2026-41672
- xmldom has XML node injection through unvalidated processing instruction serialization - CVE-2026-41675
- xmldom has XML node injection through unvalidated comment serialization - xmldom - CVE-2026-41672
You might also like:
See something that needs correcting? Let us knowUpdated May 08, 2026