xmldom has XML injection through unvalidated DocumentType serialization

Description

The package serializes DocumentType node fields (internalSubset, publicId, systemId) verbatim without any escaping or validation. When these fields are set programmatically to attacker-controlled strings, XMLSerializer.serializeToString can produce output where the DOCTYPE declaration is terminated early and arbitrary markup appears outside it.

Recommendation

Update the @xmldom/xmldom package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 0.9.0, < 0.9.10

  < 0.8.13**

• Patched version(s): **0.9.10

  0.8.13**

References

• GHSA-f6ww-3ggp-fr8h
• CVE-2026-41674
• CWE-91
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• xmldom has XML injection through unvalidated DocumentType serialization - xmldom - CVE-2026-41674
• xmldom has XML node injection through unvalidated comment serialization - CVE-2026-41672
• xmldom has XML node injection through unvalidated processing instruction serialization - CVE-2026-41675
• xmldom has XML node injection through unvalidated comment serialization - xmldom - CVE-2026-41672

You might also like:

How do hackers hack websites?

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@xmldom/xmldom