Source: node-xmldom Version: 0.9.8-2 Severity: important X-Debbugs-Cc: [email protected] Control: found -1 0.9.6-1 Control: found -1 0.8.6-1
Hi, The following vulnerability was published for node-xmldom. CVE-2026-34601[0]: | xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 | Core) `DOMParser` and `XMLSerializer` module. In xmldom versions | 0.6.0 and prior and @xmldom/xmldom prior to versions 0.8.12 and | 0.9.9, xmldom/xmldom allows attacker-controlled strings containing | the CDATA terminator ]]> to be inserted into a CDATASection node. | During serialization, XMLSerializer emitted the CDATA content | verbatim without rejecting or safely splitting the terminator. As a | result, data intended to remain text-only became active XML markup | in the serialized output, enabling XML structure injection and | downstream business-logic manipulation. This issue has been patched | in xmldom version 0.6.0 and @xmldom/xmldom versions 0.8.12 and | 0.9.9. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-34601 https://www.cve.org/CVERecord?id=CVE-2026-34601 [1] https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp Regards, Salvatore
