CVE-2026-41672— xmldom: XML node injection through unvalidated comment serialization
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-41672
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
xmldom: XML node injection through unvalidated comment serialization
Source: NVD (National Vulnerability Database)
Vulnerability Description
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled comment content to be serialized into XML without validating or neutralizing comment-breaking sequences. As a result, an attacker can terminate the comment early and inject arbitrary XML nodes into the serialized output. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
XML注入(XPath盲注)
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-41672
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-41672
Please Login to view more intelligence information
- Release 0.9.10 · xmldom/xmldom · GitHubx_refsource_MISC
- Release 0.8.13 · xmldom/xmldom · GitHubx_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-41672
IV. Related Vulnerabilities
Same product: xmldom
- CVE-2026-41675
xmldom: XML node injection through unvalidated processing in - CVE-2026-41674
xmldom: XML injection through unvalidated DocumentType seria - CVE-2026-41673
xmldom: Denial of service via uncontrolled recursion in XML - CVE-2026-34601
xmldom: XML injection via unsafe CDATA serialization allows - CVE-2022-39353
xmldom allows multiple root nodes in a DOM
Same vendor: xmldom
- CVE-2026-41675
xmldom: XML node injection through unvalidated processing in - CVE-2026-41674
xmldom: XML injection through unvalidated DocumentType seria - CVE-2026-41673
xmldom: Denial of service via uncontrolled recursion in XML - CVE-2026-34601
xmldom: XML injection via unsafe CDATA serialization allows - CVE-2022-39353
xmldom allows multiple root nodes in a DOM
Same weakness: CWE-91
- CVE-2026-41650
fast-xml-parser XMLBuilder: XML Comment and CDATA Injection - CVE-2026-41675
xmldom: XML node injection through unvalidated processing in - CVE-2026-41674
xmldom: XML injection through unvalidated DocumentType seria - CVE-2026-27693
traccar allows XML injection in KML and GPX exports - CVE-2026-32870
Kirby has XML injection in its XML creator toolkit
V. Comments for CVE-2026-41672
No comments yet