CVE-2026-34601
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) and module.
Published Apr 2, 2026 · updated Jul 21, 2026
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) and module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9, xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator ]]> to be inserted into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without rejecting or safely splitting the terminator. As a result, data intended to remain text-only became active XML markup in the serialized output, enabling XML structure injection and downstream business-logic manipulation. This issue has been patched in xmldom version 0.6.0 and @xmldom/xmldom versions 0.8.12 and 0.9.9.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 2, 2026 · NIST NVD
Detected
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) and module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9, xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator ]]> to be inserted into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without rejecting or safely spl
Jul 21, 2026 · NIST NVD
Updated
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) and module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9, xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator ]]> to be inserted into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without rejecting or safely spl
Sources
- CVE.orgVulnerability recordCVE-2026-34601
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-34601
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) and module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9, xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator
nvd.nist.gov