DEBIAN-CVE-2026-41673

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, seven recursive traversals in lib/dom.js operate without a depth limit. A sufficiently deeply nested DO...

CVE-2026-41673 vulnerabilities

Vulnerabilities for packages: actions-runner, gitlab-rails-ce, wazuh-dashboard-fips, gitlab-rails-ce-fips, sqlpad, arangodb, wazuh-dashboard, saf, npm, librechat...

2c2p-integration (>=0.2.0 <=0.2.2), 4help-shared (>=1.0.8 <=1.0.15) +4860 more potentially affected by CVE-2026-41673 via @xmldom/xmldom (>=0.7.0 <=0.8.12)

@xmldom/xmldom NPM version =0.7.0, =0.2.0, =1.0.8, =0.1.3, =0.0.7, =0.3.31, =0.1.3, =1.0.4, =1.0.0, =1.2.13 and more Source cves: CVE-2026-41673 Source advisory: SNYK:JS-XMLDOMXMLDOM-16134530...

08cms (=1.0.0), 0uth (>=1.0.5 <=1.2.1) +13070 more potentially affected by CVE-2026-41673 via xmldom (>=0.1.11 <=0.6.0)

xmldom NPM version =0.1.11, =1.0.5, =1.0.0, =1.0.0, =1.7.3, =0.1.0, =0.0.2, =0.0.1, =1.0.2, =1.0.3, =1.0.23, =1.0.1, =1.3.1 and more Source cves: CVE-2026-41673 Source advisory: OSV:GHSA-2V35-W6HQ-6MFW...