Description
The package serializes DocumentType node fields (internalSubset, publicId, systemId) verbatim without any escaping or validation. When these fields are set programmatically to attacker-controlled strings, XMLSerializer.serializeToString can produce output where the DOCTYPE declaration is terminated early and arbitrary markup appears outside it.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 0.6.0
References
Could your website be exposed too?
SmartScanner can check your website for xmldom has XML injection through unvalidated DocumentType serialization - xmldom and gives you actionable findings to investigate.
Start a free scanRelated Issues
- xmldom has XML injection through unvalidated DocumentType serialization - CVE-2026-41674
- xmldom has XML node injection through unvalidated comment serialization - CVE-2026-41672
- xmldom has XML node injection through unvalidated comment serialization - xmldom - CVE-2026-41672
- xmldom has XML node injection through unvalidated processing instruction serialization - xmldom - CVE-2026-41675
You might also like:
See something that needs correcting? Let us knowUpdated May 08, 2026