CVE-2026-41675— xmldom: XML node injection through unvalidated processing instruction serialization

xmldom: XML node injection through unvalidated processing instruction serialization

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled processing instruction data to be serialized into XML without validating or neutralizing the PI-closing sequence ?>. As a result, an attacker can terminate the processing instruction early and inject arbitrary XML nodes into the serialized output. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.

N/A

XML注入(XPath盲注)

XMLDOM 安全漏洞

XMLDOM是jindw个人开发者的一个 W3C DOM for Node 的 JavaScript 实现。 XMLDOM 0.9.10之前版本、0.8.13之前版本和xmldom 0.6.0及之前版本存在安全漏洞，该漏洞源于序列化处理指令数据时未验证或中和PI结束序列?>，可能导致攻击者提前终止处理指令并注入任意XML节点。

N/A

N/A