CVE-2026-34601

216.73.217.22

· Published 02/04/2026 18:16 · Modified 03/04/2026 16:16

Labels: CVE-2026-34601 2026-04-02 CVE-2026-34601 CWE-91 [email protected]

Essential information

Published: 02/04/2026 18:16
Modified: 03/04/2026 16:16
Author: —
Creator: —
CVSS: 7.5 HIGH (v3.1)
CISA KEV: No
CWE: —
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS metrics

Description

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9, xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator ]]> to be inserted into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without rejecting or safely splitting the terminator. As a result, data intended to remain text-only became active XML markup in the serialized output, enabling XML structure injection and downstream business-logic manipulation. This issue has been patched in xmldom version 0.6.0 and @xmldom/xmldom versions 0.8.12 and 0.9.9.

NVD status

Status: Awaiting Analysis — CVE has been recently published to the CVE List and has been received by the NVD.
Source: [email protected]
NVD: View on NVD

Affected products (CPE)

Product	CPE
xmldom / xmldom	`cpe:2.3:a:xmldom:xmldom:0.6.0:::::::*`
@xmldom / xmldom	`cpe:2.3:a:@xmldom:xmldom:<0.8.12:::::::*`
@xmldom / xmldom	`cpe:2.3:a:@xmldom:xmldom:<0.9.9:::::::*`