xmldom: XML injection through unvalidated DocumentType serialization
Priority HIGH 77CWE-91Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 4 fixed, 3 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package serializes DocumentType node fields (internalSubset, publicId, systemId) verbatim without any escaping or validation. When these fields are set programmatically to attacker-controlled strings, XMLSerializer.serializeToString can produce output where the DOCTYPE declaration is terminated early and arbitrary markup appears outside it. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00565 47th percentileScored 2026-11-07
Fix Partial @xmldom/xmldom (npm): 0.8.13, 0.9.10Red Hat: 4 advisoriesRed Hat: 4 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| xmldom | xmldom | xmldom <= 0.6.0; @xmldom/xmldom >= 0.9.0, < 0.9.10; @xmldom/xmldom < 0.8.13 | — | No fix listed | CNA |
| — | @xmldom/xmldom (npm) | before 0.8.13 | 0.8.13 | Patch available | GHSA-f6ww-3ggp-fr8h |
| — | @xmldom/xmldom (npm) | 0.9.0 to before 0.9.10 | 0.9.10 | Patch available | GHSA-f6ww-3ggp-fr8h |
| — | xmldom (npm) | up to 0.6.0 | — | No fix listed | GHSA-f6ww-3ggp-fr8h |
- xmldom Vendorxmldom Affected xmldom <= 0.6.0; @xmldom/xmldom >= 0.9.0, < 0.9.10; @xmldom/xmldom < 0.8.13 Fixed in — No fix listed CNA
- @xmldom/xmldom (npm) Vendor— Affected before 0.8.13 Fixed in 0.8.13 Patch available GHSA-f6ww-3ggp-fr8h
- @xmldom/xmldom (npm) Vendor— Affected 0.9.0 to before 0.9.10 Fixed in 0.9.10 Patch available GHSA-f6ww-3ggp-fr8h
- xmldom (npm) Vendor— Affected up to 0.6.0 Fixed in — No fix listed GHSA-f6ww-3ggp-fr8h
Remediation
- Fix · GHSA-f6ww-3ggp-fr8h @xmldom/xmldom (npm) Fixed in 0.8.13 Advisory →
- Fix · GHSA-f6ww-3ggp-fr8h @xmldom/xmldom (npm) Fixed in 0.9.10 Advisory →
Red Hat 4 advisories
- RHSA-2026:26234 Released 2026-06-16 · Red Hat rating ImportantRed Hat Developer Hub 1.9.5 release.
- Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2026:21703 Released 2026-06-03 · Red Hat rating ImportantOpenShift Container Platform 4.20.24 bug fix and security update
- Red Hat OpenShift Container Platform 4.20 registry.redhat.io/openshift4/aws-kms-encryption-provider-rhel9, registry.redhat.io/openshift4/openshift-route-controller-manager-rhel9, registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9 +22
- RHSA-2026:21338 Released 2026-05-27 · Red Hat rating ImportantRed Hat Developer Hub 1.8.7 release.
- Red Hat Developer Hub 1.8 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
Show 1 more Red Hat advisories
- RHSA-2026:20034 Released 2026-05-26 · Red Hat rating ImportantOpenShift Container Platform 4.21.17 bug fix and security update
- Red Hat OpenShift Container Platform 4.21 registry.redhat.io/openshift4/ose-agent-installer-ui-rhel9, registry.redhat.io/openshift4/ose-aws-ebs-csi-driver-rhel9, registry.redhat.io/openshift4/ose-cluster-api-rhel9 +15
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Build of Podman Desktop | Affected | No fix yet |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Self-service automation portal 2 | Affected | No fix yet |
| Red Hat Developer Hub 1.8 | Fixed | RHSA-2026:21338 |
| Red Hat Developer Hub 1.9 | Fixed | RHSA-2026:26234 |
| Red Hat OpenShift Container Platform 4.20 | Fixed | RHSA-2026:21703 |
| Red Hat OpenShift Container Platform 4.21 | Fixed | RHSA-2026:20034 |
Not affected: 5 products
- Red Hat Developer Hub 1.8
- Red Hat Developer Hub 1.9
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4.20
- Red Hat OpenShift Container Platform 4.21
Timeline
- 2026-10-02 Threatist record created from CVE-2026-41674
- 2026-10-03 Alias added: GHSA-f6ww-3ggp-fr8h
- 2026-10-16 EPSS moved to the 50th–90th percentile
- 2026-10-25 EPSS moved to the below the 50th percentile
References
More xmldom vulnerabilities
- TI-2022-18728 xmldom allows multiple root nodes in a DOM CVSS 3.1CRITICAL 9.8
- TI-2026-57717 xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator CVSS 4.0HIGH 8.7
- TI-2026-57716 xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator CVSS 4.0HIGH 8.7
- TI-2026-57715 xmldom: Processing Instruction Target Injection Bypasses requireWellFormed CVSS 4.0HIGH 8.7
- TI-2026-57714 xmldom: Quadratic-memory consumption CVSS 4.0HIGH 8.7
- TI-2026-57712 xmldom: Quadratic-time attribute deduplication CVSS 4.0HIGH 8.7
Sources
- CVE-2026-41674 · CVE Program
- CVE-2026-41674 · NVD
- FIRST EPSS
- GHSA-f6ww-3ggp-fr8h · GitHub Advisory Database · CC BY 4.0
- CVE-2026-41674 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences