xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion - xmldom

Description

@xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator ]]> to be inserted into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without rejecting or safely splitting the terminator.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 0.6.0

References

• GHSA-wh4c-j3r5-mjhp
• CVE-2026-34601
• CWE-91
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion - CVE-2026-34601
• xmldom has XML node injection through unvalidated processing instruction serialization - xmldom - CVE-2026-41675
• xmldom has XML node injection through unvalidated comment serialization - CVE-2026-41672
• xmldom has XML node injection through unvalidated comment serialization - xmldom - CVE-2026-41672

You might also like:

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

xmldom