CVE-2026-41674

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-41674
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41674.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-41674
Aliases
Downstream
Related
Published
2026-05-07T03:47:51.140Z
Modified
2026-07-16T03:31:08.958305816Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
xmldom: XML injection through unvalidated DocumentType serialization
Details

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package serializes DocumentType node fields (internalSubset, publicId, systemId) verbatim without any escaping or validation. When these fields are set programmatically to attacker-controlled strings, XMLSerializer.serializeToString can produce output where the DOCTYPE declaration is terminated early and arbitrary markup appears outside it. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.

Database specific 
{
    "cwe_ids": [
        "CWE-91"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41674.json",
    "cna_assigner": "GitHub_M",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "@xmldom/xmldom >= 0.9.0, < 0.9.10"
                },
                {
                    "last_affected": "@xmldom/xmldom >= 0.9.0, < 0.9.10"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/xmldom/xmldom

Affected ranges

Type
GIT
Repo
https://github.com/xmldom/xmldom
Events
Introduced
c80a161172cc4d8733583bf0cf59abfa589f6d9e
Fixed
372008f9ae0e20fd69f761c7b79e202598267314
Fixed
e5c14802592685bb872c042c54c3f73758875c85
Fixed
bf396a575c4dd32ce4bd925b849dcb7e778d957c
Database specific 
{
    "extracted_events": [
        {
            "introduced": "xmldom <= 0.6.0"
        },
        {
            "last_affected": "xmldom <= 0.6.0"
        },
        {
            "introduced": "@xmldom/xmldom < 0.8.13"
        },
        {
            "last_affected": "@xmldom/xmldom < 0.8.13"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.6.0
0.7.0
0.7.0+scoped
0.7.0+unscoped
0.7.1
0.7.2
0.7.3
0.8.0
0.8.1
0.8.10
0.8.11
0.8.12
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
0.9.0
0.9.0-beta.1
0.9.0-beta.10
0.9.0-beta.11
0.9.0-beta.2
0.9.0-beta.3
0.9.0-beta.4
0.9.0-beta.5
0.9.0-beta.6
0.9.0-beta.7
0.9.0-beta.8
0.9.0-beta.9
0.9.1
0.9.2
0.9.3
0.9.4
0.9.5
0.9.6
0.9.7
0.9.8
0.9.9
@xmldom/xmldom < 0.*
@xmldom/xmldom < 0.8.13
v0.*
v0.7.0
xmldom <= 0.*
xmldom <= 0.6.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41674.json"