CVE-2026-34601 Overview
CVE-2026-34601 is an XML structure injection vulnerability in xmldom and @xmldom/xmldom, a pure JavaScript implementation of the W3C DOM Level 2 Core DOMParser and XMLSerializer. The flaw allows attacker-controlled strings containing the CDATA terminator ]]> to be inserted into a CDATASection node. During serialization, XMLSerializer emits the CDATA content verbatim without rejecting or safely splitting the terminator. As a result, data intended to remain text-only becomes active XML markup, enabling downstream business-logic manipulation. The issue is tracked under [CWE-91] (XML Injection).
Critical Impact
Attackers can break out of a CDATA section during XML serialization and inject arbitrary XML structure into downstream consumers, corrupting message integrity.
Affected Products
- xmldom versions 0.6.0 and prior
- @xmldom/xmldom versions prior to 0.8.12
- @xmldom/xmldom versions prior to 0.9.9
Discovery Timeline
- 2026-04-02 - CVE-2026-34601 published to NVD
- 2026-04-16 - Last updated in NVD database
Technical Details for CVE-2026-34601
Vulnerability Analysis
The vulnerability resides in the serialization path of the XMLSerializer component. When a CDATASection node contains user-supplied text that includes the sequence ]]>, the serializer writes that text verbatim into the output. The emitted document therefore terminates the CDATA section prematurely at the attacker-supplied terminator. Any characters that follow the injected terminator are parsed by downstream consumers as live XML markup rather than character data. This breaks the boundary between data and structure, which is the security invariant a CDATA section is supposed to enforce.
The consequence is XML structure injection. An attacker who controls a string that is later placed inside CDATA can append closing tags, sibling elements, or attributes that alter the meaning of the serialized document. Systems that consume the output, such as SOAP services, SAML processors, configuration loaders, or signed XML pipelines, may then act on attacker-defined elements.
Root Cause
The root cause is missing output neutralization in XMLSerializer. The W3C-recommended mitigation is to reject the terminator or to split a CDATA section containing ]]> into two adjacent sections (]] and ]]> becoming ]]]]><![CDATA[>). The affected versions perform neither check.
Attack Vector
Exploitation requires only that an application place untrusted text into a CDATASection and then serialize the document. No authentication or user interaction is needed when the serialized XML is exposed over the network. The vulnerability does not directly disclose data or crash the process; impact is concentrated on integrity of the produced XML and the business logic that depends on it.
The vulnerability manifests when an application calls XMLSerializer.serializeToString() on a DOM containing attacker-influenced CDATA content. See the GitHub Security Advisory GHSA-wh4c-j3r5-mjhp for technical details and the patch commit.
Detection Methods for CVE-2026-34601
Indicators of Compromise
- Serialized XML output containing more than one ]]> sequence inside a single declared <![CDATA[ ... ]]> block.
- Unexpected child elements, closing tags, or attributes appearing immediately after a CDATA section in logs of generated XML.
- Downstream XML parsers reporting structural changes or signature validation failures on documents produced by services that use xmldom.
Detection Strategies
- Inventory Node.js services and bundled front-end assets for xmldom and @xmldom/xmldom using npm ls or software composition analysis tooling.
- Inspect application code for paths where untrusted input is wrapped in createCDATASection() prior to serialization.
- Compare serialized XML against an XSD or canonical form to identify structural drift introduced after CDATA boundaries.
Monitoring Recommendations
- Log and alert on XML signature verification failures in SAML, SOAP, and XML-DSig workflows that consume output from internal services.
- Capture outbound XML payloads from services using xmldom and scan for the literal substring ]]> appearing more than once within a CDATA region.
- Track dependency upgrade status in CI to confirm fixed versions are deployed across all services.
How to Mitigate CVE-2026-34601
Immediate Actions Required
- Upgrade @xmldom/xmldom to version 0.8.12 or 0.9.9, and xmldom to a patched release that includes the fix.
- Audit application code for any use of document.createCDATASection() with untrusted input and refactor to use text nodes where possible.
- Validate or escape any user-controlled string before it enters a CDATA section, rejecting input that contains ]]>.
Patch Information
The maintainers fixed the issue in @xmldom/xmldom 0.8.12 and @xmldom/xmldom 0.9.9. The corrective change in commit 2b852e8 makes XMLSerializer handle CDATA terminators safely during output.
Workarounds
- Replace createCDATASection() with standard text nodes; the DOM will encode reserved characters automatically.
- Pre-sanitize untrusted strings by splitting occurrences of ]]> into ]]]]><