2c2p-integration (>=0.2.0, <=0.2.2), 4help-shared (>=1.0.8, <=1.0.15) +4305 more potentially affected by CVE-2026-34601 via @xmldom/xmldom (>=0.7.0, <=0.8.11)

@xmldom/xmldom NPM version =0.7.0, =0.2.0, =1.0.8, =0.1.3, =0.0.7, =0.3.31, =1.0.4, =1.0.0, =2.1.0-develop-2ff6c7-mckmjkzz, =0.0.1, =0.0.2 - @abcd19/st-grid 3.1.0 and more Source cves: CVE-2026-34601 Source advisory: OSV:GHSA-WH4C-J3R5-MJHP...

08cms (1.0.0), 0uth (>=1.0.5, <=1.2.1) +12674 more potentially affected by CVE-2026-34601 via xmldom (>=0.1.2, <=0.6.0)

xmldom NPM version =0.1.2, =1.0.5, =1.0.0, =1.0.0, =1.7.3, =0.1.0, =0.0.2, =0.0.1, =1.0.2, =1.0.3, =1.0.23, =1.0.1, =1.3.1 and more Source cves: CVE-2026-34601 Source advisory: SNYK:JS-XMLDOM-15869637...

@adobe/helix-importer-jcr-packaging (>=2.0.2, <=2.0.16), @aidin36/xmp (>=0.1.0, <=0.2.2) +35 more potentially affected by CVE-2026-34601 via @xmldom/xmldom (>=0.9.0, <=0.9.8)

@xmldom/xmldom NPM version =0.9.0, =2.0.2, =0.1.0, =5.5.3, =1.0.22, =1.35.0, =1.5.1-beta.1723, =0.1.0, =2.1.2, =2.6.1, =2.98.0, =3.1.0, =254.1008.0, =254.1026.0, =264.1004.0-beta.4 and more Source cves: CVE-2026-34601 Source advisory: OSV:GHSA-WH4C-J3R5-MJHP...

@adobe/helix-importer-jcr-packaging (>=2.0.2, <=2.0.16), @aidin36/xmp (>=0.1.0, <=0.2.2) +35 more potentially affected by CVE-2026-34601 via @xmldom/xmldom (>=0.9.0, <=0.9.8)

@xmldom/xmldom NPM version =0.9.0, =2.0.2, =0.1.0, =5.5.3, =1.0.22, =1.35.0, =1.5.1-beta.1723, =0.1.0, =2.1.2, =2.6.1, =2.98.0, =3.1.0, =254.1008.0, =254.1026.0, =264.1004.0-beta.4 and more Source cves: CVE-2026-34601 Source advisory: SNYK:JS-XMLDOMXMLDOM-15869636...

08cms (1.0.0), 0uth (>=1.0.5, <=1.2.1) +11361 more potentially affected by CVE-2026-34601 via xmldom (>=0.1.2, <=0.5.0)

xmldom NPM version =0.1.2, =1.0.5, =1.0.0, =1.0.0, =1.7.3, =0.1.0, =0.0.2, =0.0.1, =1.0.23, =1.0.0, =0.0.3, =0.0.9 and more Source cves: CVE-2026-34601 Source advisory: OSV:GHSA-WH4C-J3R5-MJHP...

xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion

Summary @xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator to be inserted into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without rejecting or safely splitting the terminator. As a result, data intended to remain...

GHSA-WH4C-J3R5-MJHP xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion

Summary @xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator to be inserted into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without rejecting or safely splitting the terminator. As a result, data intended to remain...

XML Injection

Overview org.webjars.npm:xmldom is an A pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Affected versions of this package are vulnerable to XML Injection via the XMLSerializer function. An attacker can manipulate the structure and integrity of generated...

org.webjars.npm:adal-node (0.1.28), org.webjars.npm:canvg (>=1.5.2, <=1.5.3) +14 more potentially affected by CVE-2026-34601 via org.webjars.npm:xmldom (>=0.1.31, <=0.6.0)

org.webjars.npm:xmldom MAVEN version =0.1.31, =1.5.2, =0.7.2, =0.14.0, =0.11.0, =7.14.0, =2.7.0, =2.9.2 and more Source cves: CVE-2026-34601 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15869638...

2c2p-integration (>=0.2.0, <=0.2.2), 4help-shared (>=1.0.8, <=1.0.15) +4305 more potentially affected by CVE-2026-34601 via @xmldom/xmldom (>=0.7.0, <=0.8.11)

@xmldom/xmldom NPM version =0.7.0, =0.2.0, =1.0.8, =0.1.3, =0.0.7, =0.3.31, =1.0.4, =1.0.0, =2.1.0-develop-2ff6c7-mckmjkzz, =0.0.1, =0.0.2 - @abcd19/st-grid 3.1.0 and more Source cves: CVE-2026-34601 Source advisory: SNYK:JS-XMLDOMXMLDOM-15869636...

PT-2026-29497

Name of the Vulnerable Software and Affected Versions xmldom versions 0.6.0 and prior, and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9 Description The xmldom library contains a flaw where attacker-controlled strings including the CDATA terminator can be inserted into a CDATASection node...

MiracleLinux 8 : python3.11-3.11.13-4.el8_10 (AXSA:2026-103:03)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-103:03 advisory. cpython: Excessive read buffering DoS in http.client CVE-2025-13836 cpython: python: cpython: Quadratic algorithm in xml.dom.minidom leads to denial ...

Security Bulletin: IBM Spectrum Control is vulnerable to weakness related to xmldom (CVE-2021-32796)

Summary Vulnerability in JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module may affect IBM Spectrum Control. Vulnerability Details CVEID:CVE-2021-32796 DESCRIPTION: xmldom is an open source pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses xmldom-0.8.10.tgz which is vulnerable to this CVE-2021-32796

Summary Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses xmldom-0.8.10.tgz which is vulnerable to this CVE-2021-32796 Vulnerability Details CVEID:CVE-2021-32796 DESCRIPTION: xmldom is an open source pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParse...

EUVD-2021-1574

Malware in sbrugna...

EUVD-2022-7316

Malicious code in bioql PyPI...

EUVD-2022-7067

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2022-39353

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. xmldom parses XML that is not well-formed because it...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in xmldom-0.9.8.tgz

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of xmldom-0.9.8.tgz Vulnerability Details CVEID:CVE-2021-32796 DESCRIPTION: xmldom is an open source pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older ...

Security Bulletin: IBM App Connect Enterprise is vulnerable to Improper Encoding or Escaping of Output due to xmldom ( CVE-2021-32796 )

Summary IBM App Connect Enterprise is vulnerable to Improper Encoding or Escaping of Output due to xmldom. Vulnerability Details CVEID:CVE-2021-32796 DESCRIPTION: xmldom is an open source pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. xmldom versions...