CVE-2026-41672

216.73.217.22

· Published 07/05/2026 04:16 · Modified 07/05/2026 16:16

Labels: CVE-2026-41672 2026-05-07 CVE-2026-41672 CWE-91 [email protected]

Essential information

Published: 07/05/2026 04:16
Modified: 07/05/2026 16:16
Author: —
Creator: —
CVSS: 8.7 HIGH (v3) 8.7 HIGH (v4.0)
CISA KEV: No
CWE: —
CVSS vector: —

CVSS metrics

Description

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled comment content to be serialized into XML without validating or neutralizing comment-breaking sequences. As a result, an attacker can terminate the comment early and inject arbitrary XML nodes into the serialized output. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.

NVD status

Status: Deferred — CVE has been recently published to the CVE List and has been received by the NVD.
Source: [email protected]
NVD: View on NVD

Affected products (CPE)

Product	CPE
xmldom / xml dom	`cpe:2.3:a:xmldom:xml_dom::::::::`