Skip to content
fr Sign in
8.7 High

CVE-2026-41674 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module

Description

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package serializes DocumentType node fields (internalSubset, publicId, systemId) verbatim without any escaping or validation. When these fields are set programmatically to attacker-controlled strings, XMLSerializer.serializeToString can produce output where the DOCTYPE declaration is terminated early and arbitrary markup appears outside it. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.

Affected products and versions

Product Affected versions Fixed in
xmldom Versions not published
Red Hat Developer Hub 1.8 1779841586 earliest → < 1779841586 1779841586
Red Hat Developer Hub 1.9 1781187342 earliest → < 1781187342 1781187342
Red Hat OpenShift Container Platform 4.20 1779864090 earliest → < 1779864090 1779864090
Red Hat OpenShift Container Platform 4.21 1779252093 earliest → < 1779252093 1779252093
Red Hat Build of Podman Desktop Versions not published
Red Hat Fuse 7 Versions not published
Self-service automation portal 2 Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Show the other branch
Product Affected versions Fixed in
Red Hat OpenShift Container Platform 4.2 1779864090 earliest → < 1779864090 1779864090

References

Timeline

  1. Published
  2. Last modified

Other CVEs of xmldom

The 23 CVEs of xmldom →
CVE-2026-83619 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module 8.7 High CVE-2026-83618 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module 8.7 High CVE-2026-83617 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module 8.7 High CVE-2026-83616 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module 8.7 High
Track this CVE