Description
@xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator ]]> to be inserted into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without rejecting or safely splitting the terminator.
Recommendation
Update the @xmldom/xmldom package to the latest compatible version. Followings are version details:
Affected version(s): **>= 0.9.0, < 0.9.9 < 0.8.12** Patched version(s): **0.9.9 0.8.12**
References
Could your website be exposed too?
SmartScanner can check your website for xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion and gives you actionable findings to investigate.
Start a free scanRelated Issues
- xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion - xmldom - CVE-2026-34601
- xmldom has XML node injection through unvalidated comment serialization - CVE-2026-41672
- xmldom has XML node injection through unvalidated processing instruction serialization - CVE-2026-41675
- xmldom has XML injection through unvalidated DocumentType serialization - CVE-2026-41674
You might also like:
See something that needs correcting? Let us knowUpdated April 24, 2026