XML injection in xmldom - CVE-2026-34601

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU126510

XML injection in xmldom - CVE-2026-34601

Published: April 20, 2026


Vulnerability identifier: #VU126510
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-34601
CWE-ID: CWE-91
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to inject XML markup into serialized output.

The vulnerability exists due to improper neutralization of special elements in XMLSerializer CDATA serialization when serializing attacker-controlled CDATA content containing the CDATA terminator. A remote attacker can supply a crafted string that includes ]]> to inject XML markup into serialized output.

Applications are affected when they embed untrusted input inside CDATA sections in generated XML documents, and mutation methods such as appendData(), replaceData(), direct .data assignment, or .textContent assignment can also introduce the unsafe content.


Affected software

xmldom
Langflow
Automation Assets in IBM Cloud Pak for Integration (CP4I)
IBM Decision Optimization for Cloud Pak for Data
Rational Performance Tester
DevOps Test Performance
IBM App Connect Enterprise

How to mitigate CVE-2026-34601

Install security update from vendor's website.

xmldom - addressed in versions 0.8.12, 0.9.9
Langflow - update to 1.9.0
Automation Assets in IBM Cloud Pak for Integration (CP4I) - update to 4.0.20-sc2
IBM Decision Optimization for Cloud Pak for Data - update to 5.3.1 patch 4
DevOps Test Performance - update to 11.0.8
IBM App Connect Enterprise - addressed in versions 12.0.12.25, 13.0.7.1

External References

Related Security Bulletins