xmldom has XML injection through unvalidated DocumentType serialization - xmldom

Description

The package serializes DocumentType node fields (internalSubset, publicId, systemId) verbatim without any escaping or validation. When these fields are set programmatically to attacker-controlled strings, XMLSerializer.serializeToString can produce output where the DOCTYPE declaration is terminated early and arbitrary markup appears outside it.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.6.0

References

• GHSA-f6ww-3ggp-fr8h
• CVE-2026-41674
• CWE-91
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• xmldom has XML injection through unvalidated DocumentType serialization - CVE-2026-41674
• xmldom has XML node injection through unvalidated comment serialization - CVE-2026-41672
• xmldom has XML node injection through unvalidated comment serialization - xmldom - CVE-2026-41672
• xmldom has XML node injection through unvalidated processing instruction serialization - xmldom - CVE-2026-41675

You might also like:

How do hackers hack websites?

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

xmldom