CVE-2026-34601

Summary

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9, xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator ]]> to be inserted into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without rejecting or safely splitting the terminator. As a result, data intended to remain text-only became active XML markup in the serialized output, enabling XML structure injection and downstream business-logic manipulation. This issue has been patched in xmldom version 0.6.0 and @xmldom/xmldom versions 0.8.12 and 0.9.9.

Affected Software

VendorProductVersion RangeStatus
xmldomxmldomxmldom <= 0.6.0affected
xmldomxmldom@xmldom/xmldom < 0.8.12affected
xmldomxmldom@xmldom/xmldom >= 0.9.0, < 0.9.9affected

Weaknesses

  • CWE-91: CWE-91: XML Injection (aka Blind XPath Injection)

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: yes
    • Technical Impact: partial

Additional References

xmldom: xmldom: XML structure injection via CDATA terminator

Additional References

References