XML injection in xmldom - CVE-2026-41674
Published: April 20, 2026
Vulnerability identifier: #VU126512
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-41674
CWE-ID: CWE-91
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to inject arbitrary XML markup into serialized output.
The vulnerability exists due to xml injection in DocumentType serialization when serializing attacker-controlled DocumentType fields. A remote attacker can supply crafted publicId, systemId, or internalSubset values to inject arbitrary XML markup into serialized output.
The issue is reachable through programmatic createDocumentType calls or direct writes to DocumentType properties, while the parse path is described as safe.
Affected software
xmldom
How to mitigate CVE-2026-41674
Install security update from vendor's website.
xmldom - addressed in versions 0.8.13, 0.9.10