XML Injection Affecting @xmldom/xmldom package, versions <0.8.13>=0.9.0 <0.9.10
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-XMLDOMXMLDOM-16134549
- published23 Apr 2026
- disclosed22 Apr 2026
- creditTharVid
Introduced: 22 Apr 2026
NewCVE-2026-41674 (opens in a new tab)How to fix?
Upgrade @xmldom/xmldom to version 0.8.13, 0.9.10 or higher.
Overview
@xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom
Affected versions of this package are vulnerable to XML Injection in the serialization of DocumentType nodes when attacker-controlled values are provided to the publicId, systemId, or internalSubset fields. An attacker can inject arbitrary XML markup into the serialized output by supplying specially crafted input to these fields, potentially leading to the injection of malicious DOCTYPE declarations or markup outside the intended context.
Note:
This is only exploitable if untrusted data is passed programmatically to createDocumentType or written directly to the relevant properties and then serialized without enabling strict validation.
Workaround
This vulnerability can be mitigated by passing the option { requireWellFormed: true } to XMLSerializer.serializeToString() to enforce validation of the affected fields.