Aller au contenu
en Se connecter
7.5 Élevée

CVE-2026-34601 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module

Description

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and 0.9.9, xmldom/xmldom allows attacker-controlled strings containing the CDATA terminator ]]> to be inserted into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without rejecting or safely splitting the terminator. As a result, data intended to remain text-only became active XML markup in the serialized output, enabling XML structure injection and downstream business-logic manipulation. This issue has been patched in xmldom version 0.6.0 and @xmldom/xmldom versions 0.8.12 and 0.9.9.

Produits et versions touchés

Produit Versions touchées Corrigé en
xmldom Versions non publiées
Migration Toolkit for Applications 8 Versions non publiées
Red Hat Build of Podman Desktop Versions non publiées
Red Hat Developer Hub Versions non publiées
Red Hat Fuse 7 Versions non publiées
Red Hat OpenShift AI (RHOAI) Versions non publiées
Red Hat OpenShift Container Platform 4 Versions non publiées
Red Hat OpenShift Dev Spaces Versions non publiées
Self-service automation portal 2 Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de xmldom

Les 23 CVE de xmldom →
CVE-2026-83619 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module 8.7 Élevée CVE-2026-83618 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module 8.7 Élevée CVE-2026-83617 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module 8.7 Élevée CVE-2026-83616 xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module 8.7 Élevée
Suivre cette CVE