CVE-2026-41674

CVE-2026-41674 affects the xmldom/xmldom package. Before version 0.9.10 and 0.8.13 (and for the 0.6.0 line), DocumentType node fields internalSubset, publicId, and systemId are serialized verbatim by XMLSerializer without escaping or validation. If attackers set these fields to malicious strings,...

XML Injection

Overview org.webjars.npm:xmldom is an A pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Affected versions of this package are vulnerable to XML Injection due to unvalidated comment serialization. When an application uses the package to create an XML...